I've hardened my server with the NSA & CIS security guidance. Now when my session goes to locked screensaver mode, it won't unlock. I have to do a switch user, select my account, and then unlock works.

Hoping someone can give me a clue on what security setting is causing this.

Most likely pam settings - If something is set incorrectly or is too restrictive it can lock a regular user out. This usually involves the faillog. The faillog is only readable by root - if you have any pam settings checking how many failed attempts then this could be the issue. I know gnome-screensaver actually has a patch out that was supposed to fix the faillog issue.

--This is what GNOME website says:

First, make sure that your caps lock key is not on. It may sound silly but this is actually one of the most common reasons for password authentication failure. gnome-screensaver will print a warning if it detects the caps lock key is on.

If you are using a vendor provided package please contact your vendor for help. If you have built gnome-screensaver from source then try the test-passwd command that is located in the src directory of the gnome-screensaver sources. There are typically two reasons for why this command can fail:

* If your system supports PAM authentication, the gnome-screensaver PAM setup may either not be installed or may be incorrect.

To determine if your system supports PAM, look at the summary that is printed at the end of the configure process. You may need to manually install the gnome-screensaver PAM configuration file into /etc/pam.d (GNU/Linux) or add it to /etc/pam.conf (Solaris). There is a warning message to this effect displayed when you do 'make install'. If you use SuSE or Novell GNU/Linux you may have to modify the PAM configuration file that is distributed with gnome-screensaver.
* If your system does not support PAM authentication, you may need to install gnome-screensaver-dialog as setuid to root

To determine if your system requires setuid to root, look at the summary that is printed at the end of the configure process. There is a warning message to this effect displayed when you do 'make install'.