How to Configure Dynamic Lock, Bluetooth Proximity Paired Tokens, and Screen Timeout Policies in Windows 11

In enterprise corporate environments, unattended workstations represent one of the most prominent vectors for physical data breaches and insider tampering. While keyboard shortcuts (Win + L) provide instantaneous session locking, employees frequently step away from their desks without locking their screens. Standard inactivity timers help mitigate this risk, but leaving a machine unlocked for 5 to 15 minutes creates a significant vulnerability window.

Windows 11 Dynamic Lock addresses this threat by using Bluetooth proximity telemetry to detect when the primary user walks away. By pairing a smartphone or wearable token to the PC, Windows continuously monitors the device’s Received Signal Strength Indicator (RSSI). When the signal drops beyond a calibrated attenuation threshold for more than 30 seconds, Windows automatically locks the console, safeguarding corporate assets without disrupting user workflow.

Architectural Overview: Bluetooth RSSI Telemetry and Dynamic Lock Evaluation

Dynamic Lock does not function as an active tracking beacon or continuous GPS locator. Instead, it relies on passive Bluetooth radio frequency (RF) metrics managed by the Windows Logon framework:

Stage / Component	System Mechanism	Operational Role
Paired Proximity Token	Bluetooth Low Energy (BLE) / Classic Device	A personal smartphone (iOS or Android) or wearable paired directly to the Windows 11 PC.
Radio Telemetry Engine	Windows Bluetooth Radio Stack (bthport.sys)	Samples Received Signal Strength Indicator (RSSI) values in decibel-milliwatts (dBm) at regular intervals.
Signal Drop-off Evaluation	Windows Hello Companion Framework	Detects when RSSI drops below the designated threshold (typically -10 dBm below baseline or out-of-range).
Hysteresis Grace Period	30-Second Countdown Window	Filters temporary radio occlusions (e.g. stepping behind a monitor or placing a phone in a pocket).
Session Lockdown	Local Security Authority Subsystem (LSASS)	Invokes LockWorkstation() API, locks the active desktop, and blanks the display.

Crucially, Dynamic Lock is strictly a locking mechanism: it will never unlock your PC automatically when you return within range. Re-entry requires standard authentication via Windows Hello (facial recognition, fingerprint) or PIN/password, preserving zero-trust integrity.

Pairing a Mobile Proximity Token to Windows 11

Before Dynamic Lock can evaluate proximity, your smartphone must establish an authenticated Bluetooth partnership with the PC.

Step 1: Enable Bluetooth on Both Devices

1. On your smartphone (iPhone or Android), verify that Bluetooth is turned on and set to discoverable.
2. On Windows 11, open Settings and navigate to Bluetooth & devices.
3. Ensure the Bluetooth toggle switch is On.

Step 2: Pair the Smartphone

1. Click Add device and select Bluetooth.
2. Select your smartphone from the list of discovered peripherals.
3. Verify that the 6-digit numeric pairing PIN displayed on the Windows monitor matches the prompt on your phone screen.
4. Click Connect on Windows and tap Pair on your phone.

Enabling and Calibrating Dynamic Lock in Windows Settings

Once the smartphone is linked, activate proximity locking within the sign-in preferences:

1. Navigate to Settings > Accounts > Sign-in options.
2. Scroll down to the Additional settings section and click on Dynamic lock.
3. Check the box: Allow Windows to automatically lock your device when you’re away.
4. Windows searches active Bluetooth devices, pairs with your smartphone, and displays: “Paired with [Your Phone Name]” alongside a green checkmark.

Tuning Unattended Sleep and Screen Timeout Policies

When Dynamic Lock fires, it locks the workstation into the Windows lock screen. However, to conserve power and prevent passersby from viewing background notifications on the lock screen, tune your display turn-off thresholds.

Step 1: Configure Screen Turn-Off Timers

1. Navigate to Settings > System > Power & battery.
2. Expand the Screen and sleep dropdown.
3. Configure:
   • When plugged in, turn off my screen after: Set to 3 minutes or 5 minutes.
   • When plugged in, put my device to sleep after: Set to 15 minutes.

Step 2: Tighten the Lock Screen Display Timeout via Registry

By default, Windows leaves the lock screen display illuminated for 60 seconds after a session is locked before putting the monitor into low-power standby. To reduce this interval to 15 seconds:

# Open elevated PowerShell and unhide the Console Lock Display Off timeout setting
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\7516b95f-f776-4464-8c53-06167f40cc99\8EC4B3A5-6868-48c2-BE75-4F3044BE88A7" `
  -Name "Attributes" -Value 2

# Navigate to Classic Control Panel > Power Options > Edit Plan Settings > Change advanced power settings
# Under "Display", adjust "Console lock display off timeout" from 1 Minute to 15 Seconds

Deploying Dynamic Lock via Enterprise Group Policy and Intune

Enterprise administrators managing fleets of hybrid enterprise laptops can mandate Dynamic Lock adoption using Intune Configuration Profiles or Active Directory GPO.

Configuring Group Policy Objects (GPO)

Navigate to the following policy path under Computer Configuration > Administrative Templates > Windows Components > Windows Hello for Business:

# Policy: Configure Dynamic Lock
# Registry Key: HKLM\SOFTWARE\Policies\Microsoft\Windows\DynamicLock
# Value Name: EnableDynamicLock
# Data Type: REG_DWORD
# Value: 1 (Enabled - Mandates Dynamic Lock enforcement)
# Value: 0 (Disabled)

Intune Settings Catalog Profile

1. In the Microsoft Intune admin center, go to Devices > Configuration > Create profile.
2. Select Windows 10 and later > Settings catalog.
3. Search for Dynamic Lock under the Device Lock or Windows Hello For Business categories.
4. Enable Enable Dynamic Lock and deploy to target corporate device groups.

Troubleshooting Dynamic Lock and Bluetooth Proximity Faults

Consult this diagnostic matrix to resolve proximity lock failures:

Symptom	Underlying Root Cause	Remediation Procedure
“Dynamic lock is not working because Bluetooth is off” error in Settings.	Host Bluetooth adapter is disabled, or the phone’s Bluetooth radio was toggled off.	Ensure Bluetooth is enabled on both endpoints. If using a desktop without onboard Bluetooth, verify USB dongle drivers.
PC fails to lock when walking away with phone.	The phone remains within Bluetooth radio range (standard Class 2 radios can transmit up to 10 metres through walls), or phone power management halted Bluetooth polling.	Disable aggressive battery saver on Android for Bluetooth services. Test walking further away, or place the phone in your pocket to naturally attenuate the 2.4 GHz RF signal.
Workstation locks repeatedly while sitting directly in front of it.	RF interference (from 2.4 GHz Wi-Fi or USB 3.0 cables), or phone entered deep sleep and dropped connection.	Unpair and re-pair the phone. Move physical USB 3.0 external storage cables away from the Bluetooth antenna to eliminate RF desensitisation.
Checkbox “Allow Windows to automatically lock your device” is greyed out.	System is managed by corporate policy that has locked biometric or dynamic lock settings.	Inspect active MDM policies via dsregcmd /status or verify GPO registry entries under HKLM\SOFTWARE\Policies\Microsoft\Windows\DynamicLock.

Configuring Dynamic Lock alongside calibrated display sleep policies establishes a robust defence-in-depth perimeter, safeguarding sensitive enterprise sessions the moment you walk away from your desk.