Screen saver/ wall paper policy

I hate restricting my users. Sometimes I have to, but I prefer to educate rahter than restrict.

My users are restricted from installing any software, but they are free to make any changes to their desktop and screensaver, that don't require software installation.

We will use a standard wallpaper and blank screensaver on PCs that are in public-facing areas. Otherwise, we let give our users a certain amount of freedom with wallpaper (however in Local Government our users have to abide by a "Dignity at Work" policy so nudity/violence/religious/racist etc stuff that may offend a colleague is out). We also restrict screen savers to those supplied with Windows; as we don't allow our users to install their own software or update the OS.

We consider locking the machine with a password protected screen saver after 15 minutes of inactivity to be more important, so all machines will lock after 15 minutes inactivity, 5 minutes for machines in public areas. Whilst this is a poor substitute for good training, it does offer an individual some degree of protection against someone using their logon should they be called away from their desk in a hurry.

Our business is selling and servicing cars. Our users are only allowed product related screen savers and wallpapers. We do not allow any competitive products (if you work at the Toyota store and your favourite vehicle is a Harley, sorry not allowed.) Any others are removed when found and a warning issued to the user.

This policy not only eliminates the possiblity of offending customers and other users but helps with marketing.

As much as I would love to allow people the flexibility, in a corporate network environment, giving people unrestricted access to wallpaper and screen savers is inviting disaster.

You should block your users' ability to install either one. Only I.T. should be able to add wallpapers or screen saver options.

Best thing is to provide a reasonable selection of both and allow the user to select their preference.

Hank Arnold

In my County government setting users have written procedures against installing any software, including software, they do it anyway. The problem is with enforcement; management doesn't always back you up...there is always an exception.
Recently we found a problem with custom toolbars and screensavers that caused real problems with a several hundred-thousand dollar pilot project. Once the unapproved software was removed the users, some upper management, could successfully participate.
The posts here all appear to have common themes: keep the users happy and don't take away freedoms they already have. You may have to come to some middle ground: use default or IT supplied screen savers or help them set up a slide-show type screen saver, through XP, providing the workstations are adequately protected against known security threats.
You are in a unique position to make changes due to your OS upgrade. It is the perfect time to evaluate and/or modify policy.

Hi, in my exprience managing large networks I have found that restricting all third party screen savers especialy those downloaded from the web is the best practice, to minimize application problems that would affect business operations. The bigest ofendors are screen savers that also add other web toolbars tracking weather, sports. These could put serious demands on banwith and open the oportunity for other problems like spyware and keyloggers to gain access to network PC's. The policy should be very clear and on what users can and can not do on work computers with a streamlined process on how to address policy violations. I can tell you that we have over 5000 Desktops and when it comes to network security we lock everthing down as much as posible via group policies; preventing non IS staff members from performing any installs that are not part of the standard configuration agreed by the organiozation.
Regards
Luis Rodriguez
Business Applications Analyst
Pharmacy Technoloy BMC.

I work in a setting where we are a HIPAA covered entity. We have set via GPO a default screensaver and a lock on the system when the screensaver goes on. A 15-30 minute delay depending upon the location of the machine is what we're working with.

Also, if you are backing up a machine that is running a screensaver more complex than the basics from MS (no 3D), then your back-up will take a performance hit.

I hated doing it to my users, but, I really didn?t have much choice. Users were downloading and installing everything and anything they could get their hands on, and fixing all the resulting issues this caused (slow machines, spyware, viruses, etc.) reached a point where it was over-utilizing IT resources.

After getting the blessing of the heads of our local business units, I locked all the pc's down with policies using a plain background and the default cursor and screensaver.

The users really hated it at first. But, after a few weeks even the biggest offenders began to notice how much better their pc ran and how the number of issues drastically declined. There were a couple who were very upset, but, because I had gotten approval from their boss beforehand, there was nothing they could do.

The bottom line is that our company views the pc as company equipment, and not the user?s plaything. With time even those who were upset with me for taking away their ability to "individualize their pc" came to understand why I had to do it. The user?s managers were all very supportive of it, as they saw how much faster I was able to respond to other, more important issues (because I wasn?t bogged down with responding to "slow computer" issues, etc.).

I must emphasize that you get management support for these changes beforehand, however. Without their support, there is no way this policy can succeed. As long as you have their buy-in, you?re golden.

As far as screensavers g, I would prefer users work with either the Windows-supplied ones or third-party screensavers that are known to bebave properly on the computers. For example, I use and trust the ScreenPaver shareware photo screensaver (www.screenpaver.com) which uses images from at least one user-nominated directory.

What I look for with screen savers is how much excess baggage they supply to the system and what they supply. With ScreenPaver, I checked what was provided by the installer and only the .SCR file was provided. Some that are written using VB, Java, .NET or other p-code may need to supply certain runtime modules, but I would be careful of any that supply more than that.

I also observe how they affect the system especially when they do a background task like virus-scanning, network-printing or file synchronization for example. I would even do a worst-case setup of a file synchronization via VPN while a screensaver is running. This makes the machine have to encrypt / decrypt data and move it out to the server while running the screensaver.

With regards,

Simon Mackay

Get the siteadvisor plugin. (mcafee - siteadvisor.com)
search for screensavers on google.
you'll see about 60% ARE infected with spyware.

why should users be performing defrags? they are not in IT and not equipped to diagnose problems. sure they are generally good. Kind of like a driver saying 'I hear a noise from transmission, why don't I change the air filter'

sure we should be concerned with keeping PCs alive. but that's not the end users concern, and spyware reduces that life.

And you're right on with the last comment. My horror is that everyone will start thinking the same. we'll all drive the same cars, go home to the same houses... I don't know if you read CS Lewis sci fi where they went to a planet where exactly this was happening.

But at work, PCs owned by the company are not the place for personalization since it's been demonstrated to 1) waste endless time of end users constantly changing wallpaper and screensavers, 2) LOTS of screensavers, i.e. whole websites are dedicated to installing spyware. maybe not keyloggers but definitely registry and performance destroying pop-up ad spyware.

Kind of like letting your kids go where ever they want, so that they can feel like un-restricted free spirits, but not telling them to keep out of seedy neighborhoods where they get robbed.

edited to show actual google results, search for 'screensavers':
sponsored hits (two)
worldwildlife.org/wallpaper - green
screensavers.com - many spyware downloads
top hits (in order)
screensavers.com - still a spyware site
screensaver.com - at least one spyware download
freesaver.com - links to spyware sites
screensavershot.com - links to spyware sites
reallyslick.com - apparently no spyware
elitesavers.com - links to spyware sites
aaascreensavers.com - at least 10 spyware downloads
nytimes.com/partners/screensavers - spyware free
g4tv.com - spyware free
screensavers.zdarma.sk - spyware free

- this was just the first page and more than HALF had spyware.

you really didn't know, did you?

Left to their own devices, users will unintentionally sabatoge themselves, the net admin and other users.... that's just our human nature. I've been a net admin since 1991 and EE since the late 70's. A lot of water has passed under the bridge. So, this is said from experience. Personally, I like wallpapers and screen savers but either or both can introduce failure points and service disruptions in a pc whether networked or not.

For instance, a background image, if it gets corrupted, can make a windows machine unbootable and you may never stumble onto the cause or solution in a reasonable amount of time. This has happened twice at my customer locations in the last 15 years. For a second instance, background images CAN consume a lot of graphics memory. Not an issue in newer machine since graphics memory has increased with new architectures.... but something to keep an eye on. What you want to be on the watch for is making sure some Lone Ranger (usually a guy type) doesn't use porn images for the background. Check your organization's IT policy. If it ain't in writting, then as an Net Admin, it may not be your place to block the event. Use common sense.

ScreenSavers can be both good and bad. If a user processes database info and a long query is running, a screen saver set to launch in 1 minute might not be a wise choice. Even 5 or 10 minutes may not be wise during a long, interactive database query. ScreenSavers usually are designed to do exactly that... save the screen! The underlying rules often say that all other processing will be either suspended or interrupted. Bottom line? A 7 minute query takes 45 minutes or never finishes and the user wants to blame someone or convince the boss to buy a new, more powerful computer.... go figure...

ScreenSavers downloaded from the web and installed by a user OFTEN contain a lot more than just screen saving images. Running in the background, it isn't unusual to find malware functioning on its own.

The policy I recommend is to disallow non-approved screensavers and set the screensaver timeout at the server (Active Directory Policy Management) to 15 minutes or more depending on the client. It gets locked down and the users cannot alter the launch time. An enforced written policy, to me, is the best approach. You can and should do only so much regarding policies. It's best to have upper level management sign-off on the written policies. The company, the employees and the net admins all know better where they stand and how policies can be administered and enforced.

Larry Martin
DataCom Systems
Austin, TX

I used to work in a company that was the technology arm for a healthcare provider. We insisted on referring to computers as "Network Connectivity Devices" and the only screensavers/wallpaper permitted were installed with the OS.

The rationale for calling computers Network Connectivity Devices was to reinforce to the end user that the box on their desk was there to facilitate their job. Nothing else. The wallpaper/screensaver thing was about making sure that the computer locked down after a period of inactivity.

It worked remarkably well. No one complained. What is on the screen past the windows makes remarkably little difference if the end user isn't expecting to use the computer beyond work.

Wallpaper is up to the user. Corporate screensaver (basically the corporate logo that bounces around).

Works for some 10,500 machines.

screen savers and wall paper, You have to log in to the site and you can't save it really. But it does set your screen saver and wallpaper.

So it is definitely controlled and limited.

Choose an OS with a nice black and green text-only screen. No more problems.

Lock it down or you'll spend your life running around fixing PC's. It's work, employees are happy because they get job satisfaction and get paid well - not because they are allowed to spend works time re-sizing pictures of Fido to go on their screens and make the workplace look untidy.

In a multiuser environment enabling a password protected screensaver often leaves many computers tied up. Users often resort to simply powering off the computer. To solve this problem, I want to give certain users the ability to unlock the computer. I don't want to give these users administrative access.

So far, the only solution I have found was a third party product called Unlock Administrator ( http://www.e-motional.com/ULAdmin.htm ). This product allows you to assign which users can unlock a system (either a full unlock or forcing the current session to close). Regular users can unlock using thier Windows username and password.

I am sure many others have the same problem. Does anyone have a better solution?