- What choices do I have?
- How does each choice work?
- What are advantages and disadvantages of each choice?
Apply WMI filtering to the GPO
- Filtering may become a performance issue. The filter has to be evaluated, and this takes time. Depending on the filter this could be up to 30 seconds (filters lasting longer are aborted – but that’s undocumented at the time of this writing).
- For each and every new workstation, you have to edit the filter again. It’s not possible to use a group here, and it’s also not possible to use environment variables (like “%computername%).
Enable Loopback processing
This will result in the following GPO application order:
- Have loopback enabled
- Belong to “Corp Screensaver Computers”
Skip Administrative Templates, use Preferences!
So there’s a value called “ScreenSaveTimeOut” of type REG_SZ (interesting – the timeout is a number, shoulnd’t it then be REG_DWORD?), and this value we are going to deploy through GPP Registry instead of ADM Templates.
- Filter for security group membership of the computer
- Filter for date or time
- Filter for the result of LDAP queries against AD
- Filter for Sites
And remember: All of this not only applies to screen saver settings. It applies to all settings you have in administrative templates - well, "almost" all of them.