What is a screen lock?
A screen lock protects a session that is already signed in. When it engages, apps keep running and nothing is closed, but the display is covered and the user must prove identity again (password, PIN, pattern or biometric) to continue. It defends against walk-up access: a coworker, visitor or thief using a device that is still logged in. It costs almost nothing to set up and applies to both workstations and mobile devices.
Screen locks on Windows workstations
- Manual lock. Users should press Windows key + L every time they leave the desk. On a Mac, Control + Command + Q locks the screen.
- Timeout lock, per user. In the screen saver settings (reached from Settings > Personalization > Lock screen), set a wait time and check On resume, display logon screen. Windows Hello PIN or biometrics can then unlock it.
- Timeout lock, enforced by policy. Group Policy can turn on a password-protected screen saver with a fixed timeout, or set the security option Interactive logon: Machine inactivity limit. When policy sets these values, the matching controls in Settings are grayed out for the user.
Many office policies use an idle timeout of about 10 to 15 minutes; sensitive or public-facing areas use shorter values.
Lock types on phones and tablets
| Lock type | Strength | Notes |
|---|---|---|
| Swipe | None | Prevents pocket taps only; does not verify identity |
| Pattern | Weak to moderate | Easy to watch over a shoulder or trace from smudges; longer patterns help |
| PIN | Moderate to strong | Use more than four digits; avoid 1234, 0000, repeated digits and birth years |
| Password or alphanumeric passcode | Strongest knowledge-based option | Slower to type, so users may resist it |
| Fingerprint | Strong and convenient | Needs a PIN or passcode fallback, which is required after a restart |
| Facial recognition | Varies | Depth-sensing systems resist photo tricks better than camera-only systems; needs a fallback |
A mobile lock works best with three companions: a short auto-lock timeout, failed-attempt restrictions (escalating delays or an erase after too many wrong entries) and, on company devices, mobile device management (MDM) profiles that enforce minimum passcode length and the timeout so users cannot weaken them.
Screen lock vs. related controls
- Lock vs. sign out: locking keeps the session and open apps; signing out ends them. Lock for short absences, sign out or shut down at the end of the day.
- Screen lock vs. account lockout: a screen lock protects an idle session; account lockout blocks sign-in after too many wrong passwords.
- Screen lock vs. encryption: a lock stops casual use of a running device; full-disk encryption protects the data if the device is stolen and powered off or the drive is removed.
Screen lock on the CompTIA A+ exam
Screen locks appear in Core 2 (220-1202) objective 2.7, which covers workstation hardening such as timeout and screen lock settings, and objective 2.8, which covers securing phones and tablets, including the different lock types. Expect to rank mobile locks: swipe is the weakest, a long passcode or a biometric backed by a strong passcode is the strongest practical choice. Scenario cues:
- A user walks away and a coworker reads their email: set a short screen lock timeout and teach Windows key + L.
- A user cannot change the screen saver timeout because the setting is grayed out: Group Policy is enforcing it.
- A phone unlocks with a swipe in a business setting: replace it with a PIN, passcode or biometric plus PIN.