A receptionist steps away from a front-desk PC for a coffee. The screen stays on, the last document stays open, and the next person to walk past can read it. Nothing was hacked. A single setting was never turned on.
Most desktop security problems on shared machines come from a small set of settings: whether the screen locks on its own, how people sign in, what happens when someone switches users, and what gets recorded. This post covers each one, what it controls, and what to check.
The inactivity limit is the setting most often left off
Windows can lock a session after a period without input. The policy is called Interactive logon: Machine inactivity limit, it is set in seconds, and when the limit is reached the session locks by invoking the screen saver. The policy is off until a value is set.
A value must be set on purpose. The US government’s Windows 11 security guidance sets an inactivity limit of 900 seconds, or 15 minutes, or less, and treats a missing limit as a finding.
For example, a front-desk PC with no limit set stays unlocked through a lunch break. The same PC with a 15-minute limit locks itself, and the next person has to sign in as themselves.
Choosing a value is a trade-off. A short limit protects an unattended screen but interrupts people who step away briefly. Set it per room or role, record the reason, and test it with the people who use the machine.
Switching users leaves the first session running
Switching users and signing out look similar from the front of the desk, but they leave different things behind. In general practice, switching starts a second account while the first session keeps running in the background. Signing out ends the session and closes its applications.
For example, an accountant switches to a colleague’s account to check one figure. The accountant’s spreadsheet, with client data open, is still in memory under the first session. Any file the colleague opens later is recorded against the colleague, but the open data belongs to the first user.
The control is simple to state and easy to skip. Sign out before a shared machine changes hands for any length of time. OmniDefend’s Windows desktop security page describes a shared-desktop setup in which individual users can quickly sign in to a shared Windows desktop, with strong authentication at sign-in, so the machine can still identify who is using it.
Sign-in methods decide what the desktop has verified
The sign-in method decides what the desktop has actually checked. A password proves knowledge of a secret. A smart card proves possession of a card. A biometric proves that an enrolled person was present at the sensor. Each proves one thing, and the three are not interchangeable.
OmniDefend’s multi-factor authentication page lists fingerprint, face, palm vein, voice, signature, smart card (through PC/SC readers), and one-time code options. A desktop that accepts only a password has verified one factor, however long the password is.
For example, a clinician’s smart card is left in the reader after a shift. The desk is now unlocked for whoever sits down, and the card reader is doing the one job it was meant to do, which is to prove possession. Removing the card should lock the desk, and that behavior should be tested on the machine rather than assumed.
Elevation and remote sessions need the same check
A user who is signed in can still do more when they elevate. Windows asks for administrator approval through User Account Control, and a remote desktop session opens the machine to another location. Both are places where a session can be used beyond its owner’s intent.
OmniDefend’s Windows desktop security page describes strong authentication for desktop sign-in, Remote Desktop, and UAC elevation. For example, an IT technician who elevates a PC to install software is asked for a second factor at that moment, not only when the desktop first unlocked.
General practice is to treat each of these as a separate check. Make sure the policy covers all three, not only the first unlock.
What the logs should show
A shared desktop’s audit trail is only useful if it can tie an action to one person. Each sign-in, lock, unlock, sign-out, and elevation should be recorded against the individual account. Logs that show only “the reception PC” tell an investigator nothing about who was there.
HIPAA’s technical safeguards, for workstations that hold electronic health information, require unique user identification and audit controls. The same principle applies outside healthcare: a shared account makes accountability impossible to establish.
OmniDefend’s Windows desktop page describes real-time reporting of accesses to a user’s desktop. For example, a manager who asks who unlocked the finance PC on a Friday evening can answer from that record, if the desktop logs are kept and reviewed.
Keeping the same settings across many machines
A single PC can be configured by hand. A fleet of forty cannot. In general practice, settings are pushed by central policy so that a machine rebuilt from an older image does not quietly lose its lock setting.
For example, a reception PC is reimaged after a fault and comes back with the inactivity limit at zero. Nobody notices until someone walks off with a screen still open. A central check that compares each machine’s settings against the policy catches this after the rebuild, not months later.
Where the desktop protection stops
The OmniDefend pages used for this post describe sign-in, unlock, elevation, shared-desktop access, and access records. They do not describe patch management or how applications are configured. Those stay with IT.
For example, a locked desktop with an unpatched browser is still exposed through that browser. Locking limits who can use the session. It does not fix the software inside it.
Test one shared desktop for a week
The most useful test is one shared desktop, in its real room, for a working week. For example, a test on the reception PC during a busy Monday will show whether a 15-minute limit is short enough to protect the screen and long enough for the staff who use it. Check each setting against what happens in practice:
- Inactivity: Does the screen lock at the set limit when nobody touches it?
- Switching: Does the first session stay open after a switch, and does the second user’s activity get recorded against them?
- Sign-in: Does removing a smart card lock the desk?
- Elevation: Is a second factor requested when an administrator elevates?
- Records: Can you find the person behind each sign-in and elevation from the log?
OmniDefend’s sales team sets up the 30-day free trial, so the test runs on your own desktops rather than a demo. Start the free trial, or request a demo to see the desktop features first.
Frequently asked questions
Why does my PC lock even when I am reading?
The screen locks after the inactivity limit passes with no input from the keyboard or mouse. Reading without touching the device can still trigger the lock if the limit is short.
Is locking the same as signing out?
No. Locking keeps the session and its applications running. Signing out ends the session. Sign out at the end of a shift or before someone else uses the machine for a long time.
What is a reasonable inactivity limit?
The US government’s Windows guidance sets a maximum of 900 seconds. A shorter value is a local decision. Record the value and the reason.
Can I rely on a password alone for a shared PC?
A password proves one factor. For a shared desktop, pair it with a second factor for sign-in, elevation, and remote sessions, or use a method that proves who is present.
Why do the logs matter if the desk is locked?
A lock stops the next person from using the screen. The log shows who used the machine before, and when. Without it, an incident on a shared desktop cannot be traced to a person.
Resources
Ayush Bhansali is a seasoned writer with a passion for unraveling the intricacies of cyber security, workforce protection, and the cutting-edge realm of SAML 2.0, FIDO, OpenID Connect and FIDO 2.0. With three years of dedicated experience, Ayush has honed his expertise in dissecting the ever-evolving landscape of technology and its impact on our digital lives. His insightful articles not only demystify complex concepts but also provide practical insights for individuals and organizations looking to fortify their digital defenses. Ayush’s writing style is characterized by its clarity and accessibility, making even the most intricate topics comprehensible to a wide audience. Through his work, Ayush strives to empower readers with the knowledge they need to navigate the rapidly advancing world of technology securely.
