Feature: Require password immediately after sleep or screen saver begins #65

New issue

Open

opened 2017-12-13 12:23:55 -08:00 by tristanthomas · 1 comment

tristanthomas commented

2017-12-13 12:23:55 -08:00

(Migrated from github.com)

Configure the the option Require password immediately after sleep or screen saver begins.

Configure the the option Require password **immediately** after sleep or screen saver begins.

luciusbono commented

2017-12-18 09:43:17 -08:00

(Migrated from github.com)

Removing this from the production roll out milestone as there is a bug (or a feature?) in macOS 10.13 that is preventing us from setting this via plists. More details here.

Normally, this setting is managed by the askForPassword and askForPasswordDelay keys in the /Library/Preferences/com.apple.screensaver plist, but Apple appears to have moved this key and there are sporadic reports as to whether setting it has any effect. Our testing in 10.13.2 has not yielded any positive results and we are unable to manage that key. We've also tried MCX profiles, and there even reports that config profiles are not working consistently.

The default time out is 5 minutes, which is longer than we like but not a serious concern. Leaving this ticket open as a resolution is likely to come from Apple eventually.

Removing this from the production roll out milestone as there is a bug (or a feature?) in macOS 10.13 that is preventing us from setting this via plists. More details [here](https://blog.kolide.com/screensaver-security-on-macos-10-13-is-broken-a385726e2ae2). Normally, this setting is managed by the `askForPassword` and `askForPasswordDelay` keys in the `/Library/Preferences/com.apple.screensaver` plist, but Apple appears to have moved this key and there are sporadic reports as to whether setting it has any effect. Our testing in 10.13.2 has not yielded any positive results and we are unable to manage that key. We've also tried MCX profiles, and there even reports that config profiles are not working consistently. The default time out is 5 minutes, which is longer than we like but not a serious concern. Leaving this ticket open as a resolution is likely to come from Apple eventually.