Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In System Preferences -> Security, the checkbox “Require password to wake this computer from sleep or screen saver” is grayed out:

screenshot

How can I re-enable the option so that I can turn it off?

I imagine this is something my IT department has rolled out using Managed Client (perhaps with these workarounds to make it actually work). Before starting the process of filing tickets with them, trying to explain the problem to them and convince them to change it, I thought it might be easier to circumvent the setting with SuperUser's help. I have tried

defaults -currentHost write com.apple.screensaver 'Require Password' -int 0

and

defaults -currentHost write com.apple.screensaver askForPassword -int 0

but neither has helped. The current defaults for are:

# defaults -currentHost read com.apple.screensaver 
{
    "Require Password" = 0;
    askForPassword = 0;
}

Directory Utility shows that the Mac is bound to an Active Directory domain; however, under the Services tab, Active Directory is not enabled.

Per Theo Belk's suggestion, I edited ~/Library/Preferences/ByHost/com.apple.screensaver.blahblah.plist with Property List Editor. That did indeed clear the checkbox, but just cosmetically: the Mac still asks for password after sleep, and resets the checkbox at that point. There is no plist for screensaver in /System/Library/User Template/English.lproj/Library/Preferences.

This is Mac OS 10.5.8.

share|improve this question
    
I have never seen that before! Does this only affect your user or are other users also affected? Is your account an admin account? Are other users currently logged in? –  Josh Oct 7 '10 at 12:24
    
@Josh: I just created a new admin “johndoe” account for testing, and the checkbox was grayed out for that account as well. My account is an admin account as well. There are no other users logged in –  Vebjorn Ljosa Oct 7 '10 at 12:47
1  
"Before starting the process of filing tickets with them, trying to explain the problem to them and convince them to change it" You do realize that enforcing passwords after a period on inactivity (why would there be a screensaver otherwise?) makes -- usually -- a lot of sense? –  Daniel Beck Oct 7 '10 at 15:38
2  
If your IT department did this (they should have), it may be a serious breach of company policy to disable it. From a security standpoint all corporate laptops should be configured that way. –  BillThor Oct 7 '10 at 16:31
1  
It may prevent goating, but does nothing to stop anyone with physical access to the laptop. At best it gives a false sense of security, at worst it provides ample opportunity for shoulder surfing, as I have to enter my password every time I open the laptop, e.g., on the train. –  Vebjorn Ljosa Oct 7 '10 at 17:18

2 Answers 2

Unless you have admin rights to the box where you can change the managed settings, it doesn't matter what you put into your own preferences, the managed settings will override it (since that's apparently how they have it configured). Regardless, I don't think it should be SuperUser's place to help you circumvent policies set forth by your management and/or IT group. You need to talk with them if you disagree with the setting.

share|improve this answer
    
this is exactly why an SE like super user exists, actually. there's no real security gain from locking the screen when the lid closes. it's kind of a liability actually, i see too many coworkers walking around with their laptops open, just so they wont get locked out. –  mendota Jun 10 '14 at 21:09

Is your Mac bound to a Directory Service? It would have to be in order for the IT department to push Managed Client prefs on you. In OS X 10.5 you can see what server the Mac is bound to in /Applications/Utilities/Directory Services. I'm just curious since you appear to be able to make new local admin accounts. Most IT departments that bother to manage preference won't give local users any admin capability.

This pref appears to be controlled per user in the com.apple.screensaver.plist. Locking the Security preference pane doesn't affect this pref and a user still should be able to change it. If your Mac is bound to the directory, the IT department could be pushing the preference out to the machine. Look in ~/Library/Preferences/or in the /ByHost folders and see if there is a com.apple.screensaver type of file there.

Since the same thing happened in a new local admin account, maybe they pushed a locked preference out with the new user template. To check that, use the terminal as root to look in /System/Library/User Template/English.lproj/Library/Preferences

share|improve this answer
    
Directory Utility shows that the Mac is bound to an Active Directory domain; however, under the Services tab, Active Directory is not enabled. Editing ~/Library/Preferences/ByHost/com.apple.screensaver._blahblah_.plist does indeed clear the checkbox, but just cosmetically: the Mac still asks for password after sleep, and resets the checkbox at that point. There is no plist for screensaver in the User Template directory. –  Vebjorn Ljosa Oct 7 '10 at 15:01
    
You can't override it. That's kinda the point of Managed settings, so that your IT department can control and maintain polices set forth by your management. You need to contact them and take it up with them. –  peelman Oct 7 '10 at 15:38
    
The IT department here has seen fit to give the user local admin privileges so one could make the case that the local user is allowed to locally admin and disable the preference. Who are we to second guess the wisdom of almighty IT? But really, your Mac is bound to AD but the directory is not used for user authentication. It probably is indeed bound to AD just to push out this little machine preference nuisance. You have the capability to unbind the machine but that is strongly not recommended. A possible compromise might be to increase the time it take for the screen saver to kick in. –  Theo Belk Oct 9 '10 at 14:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.