Title

A screen saver must be defined. (Cat III impact)

Discussion

Unattended systems are susceptible to unauthorized use and must be locked. Specifying a screen saver ensures the screen saver timeout lock is initiated properly. This protects critical and sensitive data from exposure to unauthorized personnel with physical access to the computer.

Check Content

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_CURRENT_USER Subkey: \Software\Policies\Microsoft\Windows\Control Panel\Desktop\ Value Name: SCRNSAVE.EXE Type: REG_SZ Value: scrnsave.scr

Fix Text

Configure the policy value for User Configuration -> Administrative Templates -> Control Panel -> Personalization -> "Force specific screen saver" to "Enabled" with "scrnsave.scr" specified as the Screen saver executable name.

Additional Identifiers

Rule ID: SV-48461r2_rule

Vulnerability ID: V-36774

Group Title: WINUC-000002

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.