The screen saver must be password protected.

From Windows Server 2016 Security Technical Implementation Guide

Associated with: CCI-000056

SV-88389r1_rule The screen saver must be password protected.

Vulnerability discussion

Unattended systems are susceptible to unauthorized use and must be locked when unattended. Enabling a password-protected screen saver to engage after a specified period of time helps protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.

Check content

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_CURRENT_USER Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop\ Value Name: ScreenSaverIsSecure Type: REG_SZ Value: 1

Fix text

Configure the policy value for User Configuration >> Administrative Templates >> Control Panel >> Personalization >> "Password protect the screen saver" to "Enabled".

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.