Set Windows 10 Screensaver

Set your screensaver, the timeout, and whether prompted for a login upon resume. This code is easy to select any of the built-in savers located in C:\Windows\System32, but you could enhance it to attach your own screensaver, copy it to System32, and set it as the one to use.

Note: The settings may not take effect until after a reboot

Evaluation:

# Define desired registry settings. Set remediation to match ------

# 1 = On resume display logon screen, 0 = No logon screen on resume
$ssSecure = 1

# Time in seconds
$ssTimeout = 600

# Screensaver used
$saver = "C:\WINDOWS\system32\Ribbons.scr"

#------------------------------------------------------------------

if (!((Get-WmiObject Win32_OperatingSystem).Caption -match "Microsoft Windows 10")) { Exit 0 }

$regPath = 'Control Panel\Desktop'

# Get User details including SID from Get-LocalUser
$users = Get-CimInstance -Class Win32_UserProfile -Filter "Special = $false"

#Add HKEY_USERS to a PSDrive for easy access later
New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS -ErrorAction SilentlyContinue | Out-Null

$nonCompliant = @()

# Loop through the list of users to check each for compliance
foreach ($user in $users) {
    
    # Retrieve SIDs for each user
    $sid = $user.SID
    $local = $user.LocalPath
    
    # Load Registries for users, if ntuser.dat exists
    # this prevents us from attempting to load Administrator and similar accounts
    if (Test-Path "$local\ntuser.dat") {
    
        # Load user's ntuser.dat into the registry
        & reg load "HKU\$sid" "$local\ntuser.dat" | Out-Null
        $properties = Get-ItemProperty -Path "HKU:\$sid\$regpath"
        
        # If any of these values don't match desired state, add the user name to nonCompliant list
        if ($properties.ScreenSaverIsSecure -ne $ssSecure `
            -or $properties.ScreenSaveTimeOut -ne $ssTimeout `
            -or $properties.'SCRNSAVE.EXE' -ne $saver `
            -or $properties.ScreenSaveActive -ne 1) {
            
            $nonCompliant += $user
        }
    }
}

#Clean-up the PSDrive
Remove-PSDrive -Name HKU

#If any users are non-compliant, "Exit 1" to flag remediation. Else "Exit 0" for Compliant
if ($nonCompliant.Count -gt 0) {
    Exit 1
} else { Exit 0 }

Remediation:

#Define desired registry settings. Make sure they match evaluation ------

# 1 = On resume display logon screen, 0 = No logon screen on resume
$ssSecure = 1

# Time in seconds
$ssTimeout = 600

# Screensaver used
$saver = "C:\WINDOWS\system32\Ribbons.scr"

#------------------------------------------------------------------------

$regPath = 'Control Panel\Desktop'

# Get User details including SID from Get-LocalUser
$users = Get-CimInstance -Class Win32_UserProfile -Filter "Special = $false"

# Add HKEY_USERS to a PSDrive for easy access later
New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS

foreach ($user in $users) {

    #Retrieve SIDs for each user
    $sid = $user.SID
    $local = $user.LocalPath

    # Load Registries for users, if ntuser.dat exists
    # this prevents us from attempting to load Administrator and similar accounts
    if (Test-Path "$local\ntuser.dat") {

        # Load user's ntuser.dat into the registry
        & reg load "HKU\$sid" "$local\ntuser.dat"

        # Set screensaver values
        Set-ItemProperty -Path "HKU:\$sid\$regPath" -Name ScreenSaveActive -Value 1
        Set-ItemProperty -Path "HKU:\$sid\$regPath" -Name ScreenSaverIsSecure -Value $($ssSecure)
        Set-ItemProperty -Path "HKU:\$sid\$regPath" -Name ScreenSaveTimeOut -Value $($ssTimeout)
        Set-ItemProperty -Path "HKU:\$sid\$regPath" -Name SCRNSAVE.EXE -Value $($saver)
    }
}

Remove-PSDrive -Name HKU