topic Re: Screensaver check for Mac OS in Network Access Control

Screensaver check for Mac OS

Allen P Chen — Thu, 26 Oct 2017 22:45:22 GMT

Greetings.

I know password-protected screensaver check for Mac OS is currently not supported as a posture condition, but we are able to do it on Windows using registry keys. Is there already an enhancement request filed for password-protected screensaver check for Macs (User Story)?

Thanks in advance.

Re: Screensaver check for Mac OS

Craig Hyps — Fri, 27 Oct 2017 02:51:03 GMT

Not sure what you mean by "not supported". Just because there is not predefined check, does not mean a custom check is not supported.

Yes, it is possible to use Registry checks to verify that screen saver with password protection is enabled in Windows. Not sure if still available, but I provided example in original ISE 1.0 Lab Guide with RA VPN along with remediation using a custom registry file. I think you should be able to accomplish similar with Mac OS.

I have not tested, but try creating a File Condition checks like the following:

Name: ScreenSaver-RequirePassword-Check
Operating System: Mac OSX
Compliance Module: Any Version
File Type: PropertyList
File Path: home /Library/Preferences/com.apple.screensaver.plist
Data Type: Number
Property Name: askForPassword
Operator: Equals
Value: 1

Depending on version, you may need to set the above Data Type to "String" and value to "true".

I would also expect other parameters like ScreenSaver delay can be set with the askForPasswordDelay property.

Not sure if path would be relative to home in above, or if absolute. I am assuming it appends to home and not require ~. If issue finding file, then can try omitting the leading /.

Regarding remediation scripts, there are a number of examples on the web:

https://discussions.apple.com/thread/2649977?tstart=0

https://www.jamf.com/jamf-nation/discussions/9982/require-password-after-sleep-or-screen-saver-begins

Security & Privacy: Require Password... - Jamf Nation

/Craig

Re: Screensaver check for Mac OS

Allen P Chen — Fri, 27 Oct 2017 22:46:23 GMT

Hi Craig,

Thanks for the reply. I saw it mentioned on old TAC cases that password-protected screensaver wasn't supported on Macs, so I assumed this to be the case. I took the details above and tested it in my lab. By keying off of the "askForPassword" string in the com.apple.screensaver.plist, I was able to get it to work.

Thanks again, you da man!