Dynamic Lock feature grayed out via corporate Group Policy settings on corporate laptops

Question

Dynamic Lock feature grayed out via corporate Group Policy settings on corporate laptops

John Wilson 20

Hey guys, multiple field users want to use the Windows Dynamic Lock feature to lock their screens automatically when they walk away with their corporate smartphones. However, the checkbox option under Settings > Accounts > Sign-in options is grayed out and shows the message This option is managed by your organization.Which GPO template controls this?

0 comments

2 answers

Your answer

Answer 1

The Dynamic Lock checkbox in Settings is controlled by the Windows Hello for Business “Configure dynamic lock factors” policy.

In Group Policy, this setting is located at:

Computer Configuration → Administrative Templates → Windows Components → Windows Hello for Business → Configure dynamic lock factors

When this GPO is enabled and configured (or disabled by policy), it will manage Dynamic Lock behavior and can cause the UI option in Settings > Accounts > Sign-in options to be greyed out with “This option is managed by your organization.”

References:

Answer 2

Hello

To resolve the issue where the Dynamic Lock checkbox is grayed out, you should navigate to Computer Configuration, then Administrative Templates, followed by Windows Components, and finally Windows Logon Options. Within this node, locate the policy titled Turn off Dynamic Lock. If this policy is set to Enabled, it explicitly disables the feature and hides the setting from users, which causes the specific message you are seeing in the Sign-in options menu. To allow your users to manage this setting, ensure this policy is set to Not Configured or Disabled. Note that if you are using Microsoft Intune or other MDM solutions, you should verify that no conflicting configuration profiles are applying a Deny setting to the Dynamic Lock CSP, as those will take precedence over local Group Policy objects.

Domic