Terminal server security issue with screen cache?

Hi,
I've never seen this mentioned anywhere, but at the hospital I work for, we
use a lot of thin clients with Terminal Servers. We also have PC's that
connect to them. When the client PC screen locks with the default logon.scr
screen saver while the session is idle in the background, if you switch back
to the Terminal Server session screen, there is about a 1/2 second where the
previously viewed screen is visible, then it updates to show the new screen,
which is the login screen. The problem is, it's pretty trivial to just click
on the taskbar icon of the session, bring it to the foreground, and hit
print screen in that half second, then paste it into paint, or something
like that. I've done it many times just to demonstrate the method. If there
is patient information in that screen (or any other sensitive info) it's
easy to snap a shot of it, and walk away with the data. I have tried
DE-selecting using bitmap caching in the TS client, but that doesn't affect
it.
Has anyone ever heard of alleviating this gap using settings on the client?
Thanks,

Steven
Mon Dec 19 20:01:11 CST 2005

If you feel that is a security risk then you may want to enable a logoff
screen saver in your environment being sure to train users because a logoff
screen saver will need to shut down open applications. Winexeit.scr is
available in the RK and there are many third party logoff screen
avers. --- Steve


"Gary" <phoneticallyitsgeemoonatsaratogacaredotorg> wrote in message
news:eOnD6BMBGHA.2896@TK2MSFTNGP10.phx.gbl...
> Hi,
> I've never seen this mentioned anywhere, but at the hospital I work for,
> we use a lot of thin clients with Terminal Servers. We also have PC's that
> connect to them. When the client PC screen locks with the default
> logon.scr screen saver while the session is idle in the background, if you
> switch back to the Terminal Server session screen, there is about a 1/2
> second where the previously viewed screen is visible, then it updates to
> show the new screen, which is the login screen. The problem is, it's
> pretty trivial to just click on the taskbar icon of the session, bring it
> to the foreground, and hit print screen in that half second, then paste it
> into paint, or something like that. I've done it many times just to
> demonstrate the method. If there is patient information in that screen (or
> any other sensitive info) it's easy to snap a shot of it, and walk away
> with the data. I have tried DE-selecting using bitmap caching in the TS
> client, but that doesn't affect it.
> Has anyone ever heard of alleviating this gap using settings on the
> client?
> Thanks,
>
>