AFKLocker 0.5.3

A security fix. No new features, and nothing about how AFKLocker locks your machine has changed.

The background helper could run as administrator

AFKLocker Setup relaunches itself elevated when Windows refuses a power setting write — that part is intentional, and it tells you why before it does it. What was not intentional: a child process inherits its parent's token, so a helper started from that window ran as administrator for the rest of the session. It would sit there holding a global hotkey registration and locking the session with rights it has no use for. Nothing about the helper needs them.

There were three ways in, and the first needed no clicking at all:

• Just opening the elevated window. It reconciles its saved state when it opens, and repairing an ordinary inconsistency — a helper killed in Task Manager, a startup entry removed by a cleanup tool — starts the helper.
• Switching automatic locking or the hotkey on inside it. The obvious one.
• Diagnostics. The self-test starts and stops a helper to check that it can.

The launch is now refused at the one line in the program that can start the helper, which is what makes this a property of the program rather than of its three callers.

Refusing turned out to be the easy half

Reconciliation repairs a broken state by re-applying your saved settings, and when it cannot, it converges to manual and clean. A refusal arriving in the middle of that reads exactly like "automatic mode cannot be restored" — so the first version of this fix would have quietly switched off the mode and the hotkey you had chosen, just for opening the wrong window. The subsystem now steps aside before that can happen: in the elevated window it changes nothing and reports nothing to do.

The elevated window shows the mode and hotkey controls switched off, with the reason where their status would be. It writes power settings and nothing else. Whatever you already had set keeps working, and the ordinary Setup window still changes it.

What it asks, and why that is not "are you an administrator"

The check is whether this process was raised above the token it would ordinarily have — what a UAC prompt produces — not whether it holds an administrator token.

That distinction is the whole fix on a machine with UAC switched off, or under the built-in Administrator account, where every process carries the administrator token including the helper you start yourself. Asking the simpler question there would refuse a launch that is not an escalation at all, and automatic locking and the hotkey would stop working with no way to switch them back on.

The build caught this: the CI runner is an administrator, and it failed every test that built the lock manager. It was right to.

Verifying this download

Still no code signing certificate — a recurring cost this project does not have — so SmartScreen will warn on first run:

gh attestation verify AFKLocker-0.5.3-setup.exe --repo augbastos/AFKLocker

Or check the hash against SHA256SUMS.txt below.

AFKLocker 0.5.2

Documentation only. Nothing about the program changed — if you are on 0.5.1 there is no reason to update.

The README is a third of the size

It had grown past 500 lines for a tool with one button, and length was costing it readers. The safety warning about a closed, running laptop in a bag, the notice that the binaries are not signed, and the list of power settings AFKLocker changes were all buried behind essays about how Windows behaves.

It is 184 lines now and leads with what somebody needs before deciding to install. The reasoning moved to docs/architecture.md, which is where anyone asking "why" is already looking — and which gained the whole display-guard story, previously documented nowhere but the README.

What the trim broke, and what caught it

Cutting a document by two thirds is exactly when a true-but-qualified sentence turns into a false one. An audit of the trimmed text against the source found seven places where it had:

Four caveats had simply gone — the Modern Standby gap, that OEM power utilities and Group Policy can override the settings, the twelve-hour backstop, and that Automatic mode on battery without the battery option locks and then sleeps.

Four sentences had become absolutes the code does not make: "all-or-nothing", "never blanks a screen you are typing at", "keeps asking until it works", and an uninstall that "always" removes the helper.

One was a contradiction inside the same file: a table saying manual mode leaves nothing running, twenty-five lines above the sentence explaining that AFKLocker stays alive while the session is locked.

All are restored or corrected. In every case the real behaviour was the better story — a guard that unwinds a failed change and tells you when it could not, a display guard that runs for the whole locked session rather than a countdown.

Verifying this download

Same as always — no code signing certificate, so SmartScreen will warn on first run:

gh attestation verify AFKLocker-<version>-setup.exe --repo augbastos/AFKLocker

Or check the hash against SHA256SUMS.txt below.

AFKLocker 0.5.1

A hardening release. No new features — two display bugs that only showed up on a real machine, power settings that now apply all-or-nothing, and an uninstall that checks whether it worked.

The lid pause never actually ran

Opening the lid was supposed to leave the screen alone for ninety seconds, so it does not go dark again while you are still reaching for the keyboard. The decision was made, the policy was tested — and then thrown away. The lid handler passed its result to a method that only knew how to turn the display off or stop watching, so "wait, somebody is here" did nothing at all.

Two code paths for four outcomes, both of which compiled and both of which looked right. There is one path now, and a test that fails if an outcome is ever added without being handled.

Locking suppressed its own display-off

The most recent keyboard or mouse input at the moment you lock is the click or key that did the locking. Reading that as "somebody is at the machine" started a ninety-second pause against the very action that had just asked for the screen to go out.

Input now carries that meaning only once the screen has actually been dark — before then there was nothing for anyone to wake. Opening the lid still carries it immediately, because nobody opens a laptop by accident on their way out of the room.

Power settings apply all-or-nothing

A backup written before the first change makes recovery possible, and still leaves the machine half-configured with you unaware — which for these particular settings means a laptop that believes it will keep running with the lid shut and will actually sleep.

A write that fails unexpectedly now unwinds the writes that already landed, in reverse, and reports whether that unwinding was complete. The original error is carried rather than swallowed. The backup is never deleted on a failure. Access denied still surfaces as a prompt to run as administrator, because that is a recovery path rather than a defect.

Uninstalling checks whether its cleanup worked

Both the return value and the exit code were discarded, so an uninstall could report success while a startup entry survived — pointing into a folder about to be deleted, with no AFKLocker left to remove it. It now tells you, says where to look, and continues. The same applies to restoring your power settings: if that cannot be finished, it says where your original values are saved rather than letting you believe the machine was put back.

Documentation caught up with the code

The README still described a 45-second display guard that input or opening the lid would end, and said turning automatic mode off always leaves nothing resident — none of which had been true since 0.4.1 and 0.5.0. It now describes what the code does, including the part that is easy to get wrong: Windows ignores a display-off request while there has been recent input, which is why AFKLocker keeps asking rather than asking once.

Also

• SECURITY.md — supported versions, how to report a vulnerability privately, and the properties a reviewer would otherwise have to establish from scratch: no network access, no telemetry, no keyboard hook, no service.
• A version consistency check in both workflows. The version lives in three files; bumping two of three is an ordinary slip that produces an installer whose file name, Programs and Features entry and About text disagree. On a tag it checks the tag too.
• Tests for the display guard's timing, which was the one part of that class no test could reach because it read the clock directly.

Verifying this download

Still no code signing certificate — a recurring cost this project does not have — so SmartScreen will warn on first run. You do not have to take the download on trust:

gh attestation verify AFKLocker-0.5.1-setup.exe --repo augbastos/AFKLocker

Or check the hash against SHA256SUMS.txt below.

---

Physically confirmed on one machine: screens dark on lock, lid closed, work continuing, and the screen left alone on reopening. Everything else is covered by tests against simulated machines — which is why AFKLocker Setup → Diagnostics → Export diagnostics exists: if it does not work on yours, you can say why in one file.

AFKLocker 0.5.0

A third way to lock — one key, anywhere — and a startup entry that is finally checked rather than counted.

Global lock hotkey

Choose any key or combination in AFKLocker Setup and press it anywhere to lock. It does exactly what double-clicking the icon does, through exactly the same code, so the two cannot drift apart.

Off by default, and AFKLocker does not pick a key for you. The Menu key — the one next to the right Ctrl on many keyboards — works on its own and is a good candidate precisely because almost nothing else uses it. So do combinations like Ctrl + Alt + L.

It is not a keyboard watcher

This matters enough to be explicit. There are two ways to build a hotkey. A low-level keyboard hook sees every keystroke on the machine and decides which one mattered. RegisterHotKey inverts that: Windows is told one combination, keeps the keyboard to itself, and posts a single message when exactly that is pressed.

Only the second one lets AFKLocker keep saying it does not monitor what you type, so it is the only one used. No other keystroke reaches the program, and none is recorded anywhere — including in the diagnostics bundle, which reports the key you chose and nothing about keys you press.

If another program already owns a combination, Setup says so while you are choosing it, rather than failing quietly later. Some combinations belong to Windows itself — Win + L, Ctrl + Esc, Alt + Tab, F12 — and it refuses those the same way, because Windows is asked rather than second-guessed.

Manual mode is still non-resident

Turning the hotkey on starts a small background helper, because something has to be waiting for the key. It is the same helper automatic mode uses, so switching both on does not run two of them.

Automatic	Global hotkey	Background helper
off	off	none
off	on	runs, for the hotkey
on	off	runs, for the lid
on	on	one process, both jobs

Turning one off never stops a helper the other still needs. With both off, nothing is resident and nothing is registered at sign-in, exactly as before.

Fixed: the startup entry was counted, not checked

The old check asked whether the startup command contained AFKLockerWatcher.exe. That accepts an entry left behind by an uninstalled copy in a folder that no longer exists: it looks healthy in every status screen and starts nothing.

The command is now parsed and the program compared properly — quoting, casing, environment variables, short 8.3 names and redundant path segments are all recognised as the same program, while D:\Old\AFKLockerWatcher.exe is not. Diagnostics reports it plainly:

Autostart: PASS — points to current AFKLocker helper
Autostart: FAIL — entry points to a different location

and reopening Setup rewrites a wrong entry rather than tolerating it.

Also fixed

• Settings that could not be read were treated as "the user wants nothing" — and reconciliation then wrote those defaults over the file it had just failed to read, reporting success. A single transient file lock could erase automatic mode and a saved hotkey permanently. It now changes nothing and says so.
• Uninstalling reported success while leaving the startup entry behind, pointing into a deleted folder with no AFKLocker left to remove it.
• Switching a feature off no longer forgets the key you chose. "Remembered but not active" is a state the product shows on purpose.
• Enabling a hotkey that could never work reported success instead of refusing.
• A leftover readiness signal from a crashed helper blocked every configuration change, including the repair meant to clear it.

Setup fits on the screen again

Two columns instead of one tall strip: what this machine is on the left, what you want it to do on the right. The window had grown taller than the screen, which meant scrolling to reach the buttons — and the Close button collided with Diagnostics once the scrollbar took its width.

Verifying this download

There is still no code signing certificate — a recurring cost this project does not have — so SmartScreen will warn on first run. You do not have to take the download on trust:

# Proves these exact bytes came from this repository's release workflow
gh attestation verify AFKLocker-0.5.0-setup.exe --repo augbastos/AFKLocker

Or check the hash against SHA256SUMS.txt below.

---

Physically tested on one machine: the four on/off combinations with a real helper, switching between them in both directions, a wrong startup entry detected and repaired, a real hotkey conflict end to end, and a diagnostics bundle checked for leaks. Everything else is covered by tests against simulated machines — which is exactly why AFKLocker Setup → Diagnostics → Export diagnostics exists: if it does not work on yours, you can tell me why in one file.

AFKLocker 0.4.1

Locking now turns your screens off, and keeps them off when you close the lid.

The bug

Locking did not darken a screen. AFKLocker locked the session, exited, and left the display to Windows' console lock display off timeout. That setting is sixty seconds by default, it is hidden from powercfg /q, and on some machines it never fires at all. Lock, walk away, and the lock screen could sit there glowing — on an external monitor, in full view of the room you just left.

Closing the lid did not save you either. It makes Windows reconfigure the displays, and that reconfiguration wakes the external monitor back up. It happens after the lock, so anything AFKLocker did at lock time had already been done and lost.

The fix

AFKLocker now asks for display-off right after locking, and holds it for up to 45 seconds — long enough to cover locking and then closing the lid. The request puts the panel into standby rather than painting it black, which is the difference between a monitor that is off and one that is merely dark.

The hard half is knowing when to stop, because a program that insists would blank the screen of somebody standing at the machine typing their password. Any one of these ends it immediately:

• the session is unlocked
• a key is pressed or the mouse moves
• the lid is opened
• five requests have been made, meaning something else on this machine wants the display on and gets to win
• 45 seconds pass

Then the process exits. Every ambiguous case fails towards leaving the display on.

This applies to both modes now. Manual mode previously never touched the display at all.

Honest note about the first attempt

The first version of this hung. It tore its own notification window down from inside that window's message handler; the teardown failed, the "finished" event never fired, the process never exited — and because it held a single-instance lock, every later lock skipped blanking without saying a word. It worked once, then silently stopped working.

Fixed three ways rather than one, because a silent failure deserves more than a single guard: the teardown is deferred to the next turn of the message loop, "finished" is raised before any cleanup so nothing depends on cleanup succeeding, and the single-instance lock is gone entirely. Two blankers briefly asking for the same thing is harmless; a silent opt-out is not. A watchdog ends the process regardless.

What did not change

AFKLocker.exe now lives for up to 45 seconds after locking instead of exiting immediately. It still holds no execution state, starts no service, and never keeps the machine awake — the power configuration does that, as before. The lock is complete before any of this begins and nothing here can undo it. No display timeout is ever written to your power plan.

Verifying this download

There is still no code signing certificate — a recurring cost this project does not have — so SmartScreen will warn on first run. You do not have to take the download on trust:

# Proves these exact bytes came from this repository's release workflow
gh attestation verify AFKLocker-0.4.1-setup.exe --repo augbastos/AFKLocker

Or check the hash against SHA256SUMS.txt below.

---

Verified on one laptop with an external monitor: four lock-and-close-the-lid cycles, four screens that went dark and stayed dark, no process left behind. Everything else is covered by tests against simulated machines. If it does not work on yours, AFKLocker Setup → Diagnostics → Export diagnostics produces a file you can attach to an issue.

AFKLocker 0.4.0

The release that makes AFKLocker safe to hand to someone else: it can now tell you what it can and cannot do on your machine, and it can no longer half-configure itself.

New: Diagnostics

AFKLocker Setup → Diagnostics runs a self-test and reports what this machine can actually do — whether Windows reports a lid, whether the power settings allow closed-lid operation, whether the watcher really works here, and whether the saved configuration matches reality.

Two optional tests, because they touch the running system:

• Test lid detection — asks you to close and open the lid, and reports what Windows delivered. It never locks your session. It only listens.
• Test the watcher — starts one, confirms the handshake, stops it, and puts the previous state back. If automatic mode was on, it stays on.

Export diagnostics writes a zip you can attach to an issue: a summary a person can read, JSON for tooling, and the check-by-check output.

No telemetry, no server, no account. Nothing is sent anywhere, ever. The file is written where you choose and it is yours to read first.

The bundle deliberately excludes your username, computer name, IP and MAC addresses, Wi-Fi networks, files, installed programs, processes and environment variables. Paths become placeholders like %LOCALAPPDATA%, and a path outside the known folders is reduced to just its file name. A custom power plan's name is never reported — only that it is custom. Manufacturer and model are opt-in, off by default.

Turning automatic mode on can no longer half-apply

Enabling touches three things — the saved mode, the sign-in entry, the running process — and any of them can fail. A failure now unwinds the steps before it, so you get exactly one of two outcomes: automatic and genuinely working, or manual and clean. Never something in between.

If a rollback cannot finish, it says so and lists what it could not undo, instead of reporting success.

A running watcher is no longer assumed to be a working one

The watcher now signals READY only after Windows has actually accepted the lid registration — not merely when the process starts. Enabling waits for that signal, so a watcher that could never receive lid events fails the enable and is rolled back, instead of sitting there looking healthy while nothing happens.

Setup now reports four states rather than a yes/no, and repairs drift when it opens: a watcher killed in Task Manager, a startup entry removed by a cleanup tool, a stale signal from a crash.

Fixed

With an external monitor, closing the lid left the lock screen lit. Closing the lid makes Windows reconfigure the displays, which wakes the external screen — a lid can't turn that off. In automatic mode AFKLocker now turns the displays off right after locking.

Verifying this download

There is no code signing certificate — that is a recurring cost this project does not have, so SmartScreen will warn on first run. But you do not have to take the download on trust:

# Proves these exact bytes came from this repository's release workflow
gh attestation verify AFKLocker-0.4.0-setup.exe --repo augbastos/AFKLocker

Or check the hash against SHA256SUMS.txt below. Both are free, and the attestation answers something a certificate does not: which workflow run and commit produced this file.

---

Still physically tested on one machine. Everything else is covered by 137 tests against simulated ones — which is exactly why the diagnostics bundle exists: if it does not work on yours, you can tell me why in one file.

AFKLocker 0.3.0

New: Setup in the shortcut's right-click menu

Right-click the AFKLocker desktop icon and you get an AFKLocker Setup entry. The settings window is now one click from the icon you already use, instead of a trip to the Start menu.

Installing registers it, uninstalling removes it, and the shell is notified either way — so it appears and disappears without restarting Explorer.

One thing to know on Windows 11

The entry lands in the full context menu — the one behind Show more options — unless you have the classic menu enabled. Getting into the compact Windows 11 menu requires a signed MSIX package, which this project cannot produce.

Scoping

The entry only shows up on AFKLocker's own shortcuts. A verb registered on lnkfile without a filter appears on every shortcut you own, which a small utility has no business doing.

Scoping by the shortcut's resolved target was the obvious approach and silently matches nothing — verified on a real machine rather than assumed. It is scoped by file name with a wildcard instead, which works and also survives renaming the shortcut.

---

Nothing else changed: manual mode is still the default, and locking behaves exactly as in 0.2.x.

AFKLocker 0.2.2

Setup now tells you when automatic lock cannot work on your machine, instead of looking healthy and quietly doing nothing.

The problem this fixes

Automatic mode could report a running watcher, and then never lock anything — with no way to tell why. That is the worst kind of failure: silent, and indistinguishable from working.

It happened on the development machine. Windows reported no lid device, no lid event ever arrived, and the cause turned out to be the ACPI Lid device disabled in Device Manager (under System devices).

Disabling that device is an old trick for stopping a laptop sleeping when the lid closes. AFKLocker makes it unnecessary — it configures the lid action properly instead — and it silently breaks automatic lock, because Windows then has no idea the lid moved.

What changed

• Setup detects a machine that reports no lid state and says so, in red, naming the device to check.
• That warning outranks the battery note: a machine that cannot lock at all is a bigger problem than one that merely sleeps afterwards on battery.

If you turned automatic mode on and closing the lid did nothing, this release will tell you why. Enabling the ACPI Lid device is safe once the lid action is "Do nothing", which is what Setup configures.

Nothing else changed — manual mode remains the default, and the locking behaviour is unchanged.

AFKLocker 0.2.1

Patch release. Two fixes to what Setup tells you after turning on automatic mode — the feature itself worked correctly in 0.2.0.

Fixed

Setup said "Watcher: NOT running" right after enabling automatic mode, even though the watcher had started fine. Process.Start returns as soon as the process exists, well before it has started the runtime and claimed its mutex — and the window refreshed inside that gap. The result was a scary message about a problem that did not exist. Starting the watcher now waits until it has actually registered, so the status you see is the truth.

The status message was clipped mid-sentence by a fixed control height, cutting off the end of the longer messages. It now grows to fit, like the other notes in the window. The wording is also clearer about how to recover if the watcher really is not running.

If you are on 0.2.0

Automatic lock was working — only the status line was wrong. Install over the top; your mode, shortcut and settings are preserved.

The integration test lost its artificial sleep as part of this, so the race is now covered: if it comes back, the test fails.

AFKLocker 0.2.0

New: Automatic Lid Lock

Closing the laptop lid can now lock Windows by itself.

Close the lid  →  AFKLocker locks Windows  →  Work keeps running

Manual mode remains the default and is unchanged. Automatic is opt-in, switched on in AFKLocker Setup, and never enabled by installing.

What it's for

You're working somewhere public. A build is running, or a download, or a server. You shut the laptop, walk to another room, open it again — Windows asks for your PIN, and everything you left running is still running, in the same session.

What turning it on does

• Starts AFKLockerWatcher.exe at sign-in: no window, no tray icon, no console.
• It asks Windows to report lid movement (GUID_LIDSWITCH_STATE_CHANGE) and then sleeps. No polling — it's blocked in a message loop until an event arrives. Idle it holds about 5 MB and no measurable CPU.
• On a close event it calls LockWorkStation. That's the whole job.

Turn it off and the watcher stops, the sign-in entry is removed, and nothing is resident again. Uninstalling does the same, without asking.

What it deliberately doesn't do

• It never unlocks. Opening the lid leaves Windows on the lock screen. Every time.
• It doesn't touch power settings and doesn't keep the machine awake by itself. That stays with the power configuration — Setup now shows the two separately, because they're different things.
• It doesn't watch what you're running.

Worth knowing

• The first lid event after the watcher starts is treated as a starting position, not a change, so it never locks on its own. If you work with the laptop docked and shut on an external monitor, turning this on won't lock you out.
• Automatic lock works regardless of battery settings, but if Windows is still set to sleep on lid close on battery, it will lock and then sleep. Setup says so when that applies. Battery configuration stays opt-in.
• Machines that don't report a lid (desktops, some firmware) will simply never fire. Registration succeeds either way, so this can't be detected up front — it's stated rather than papered over.

Safety

Never leave a running, lid-closed laptop in a bag, sleeve, drawer or backpack. This release makes that matter more: when lid-close means "lock", leaving the machine running stops being a deliberate decision and becomes a habit. A machine that isn't sleeping is still making heat, and a closed space traps it.

Upgrading from 0.1.x

Install over the top. Manual mode, your desktop shortcut and any existing power settings backup are all preserved, and nothing new starts running until you ask for it.

Binaries are still unsigned, so SmartScreen will warn on first run. Still physically tested on one machine only; everything else is covered by tests against simulated ones.