Build a locked-only profile

  1. Open Triggers and set every action to Do nothing.
  2. Open Windows locked and enable Monitor while Windows is locked.
  3. Choose the few responses you need, such as USB device connected → Restart and Monitor disconnected → Shut down.
  4. Set the other locked rows to Do nothing. Click Save, then close Settings.
  5. Lock Windows normally when you step away. Keep DeskLatch running in the tray.

With no actionable normal rules, Enable and Save & Enable are unavailable. That is expected: the locked profile does not need manual arming or a countdown. Normal monitoring remains grey.

What happens at lock and sign-in

Once Windows is confirmed locked, the enabled profile controls its USB, display, resume, power, lid and remote-session events. Each row requests shutdown, restart or no action. The profile waits again after a verified sign-in. It can apply to a manual Windows lock or one initiated by a Windows feature.

If you later add normal rules, remember that the locked profile takes priority for its ten events. Do nothing means suppress the event while locked; it never means inherit the normal action. Turning off the locked-profile master option allows an armed normal profile to handle its own matching events.

Test the setup

Exit the regular app and start a whole-app dry run using Test monitoring.cmd. Lock Windows, connect a harmless test peripheral, then sign in and review history. Preview builds also keep all actions simulated. For a real-action trial, save work first and verify every selected power response.

This user-session app must already be running. It does not protect before sign-in, after sign-out or while Windows is asleep. For an automatic lock transition, see Windows Dynamic Lock or screensaver sign-in. Use optional startup to open the app after your next sign-in.