How to re-enable grayed-out “Require password to wake this computer from sleep or screen saver” option on Mac OS X?

Question

In System Preferences -> Security, the checkbox “Require password to wake this computer from sleep or screen saver” is grayed out:

How can I re-enable the option so that I can turn it off?

I imagine this is something my IT department has rolled out using Managed Client (perhaps with these workarounds to make it actually work). Before starting the process of filing tickets with them, trying to explain the problem to them and convince them to change it, I thought it might be easier to circumvent the setting with SuperUser's help. I have tried

defaults -currentHost write com.apple.screensaver 'Require Password' -int 0

and

defaults -currentHost write com.apple.screensaver askForPassword -int 0

but neither has helped. The current defaults for are:

# defaults -currentHost read com.apple.screensaver 
{
    "Require Password" = 0;
    askForPassword = 0;
}

Directory Utility shows that the Mac is bound to an Active Directory domain; however, under the Services tab, Active Directory is not enabled.

Per Theo Belk's suggestion, I edited ~/Library/Preferences/ByHost/com.apple.screensaver.blahblah.plist with Property List Editor. That did indeed clear the checkbox, but just cosmetically: the Mac still asks for password after sleep, and resets the checkbox at that point. There is no plist for screensaver in /System/Library/User Template/English.lproj/Library/Preferences.

This is Mac OS 10.5.8.

Answer 1

Unless you have admin rights to the box where you can change the managed settings, it doesn't matter what you put into your own preferences, the managed settings will override it (since that's apparently how they have it configured). Regardless, I don't think it should be SuperUser's place to help you circumvent policies set forth by your management and/or IT group. You need to talk with them if you disagree with the setting.

Answer 2

Is your Mac bound to a Directory Service? It would have to be in order for the IT department to push Managed Client prefs on you. In OS X 10.5 you can see what server the Mac is bound to in /Applications/Utilities/Directory Services. I'm just curious since you appear to be able to make new local admin accounts. Most IT departments that bother to manage preference won't give local users any admin capability.

This pref appears to be controlled per user in the com.apple.screensaver.plist. Locking the Security preference pane doesn't affect this pref and a user still should be able to change it. If your Mac is bound to the directory, the IT department could be pushing the preference out to the machine. Look in ~/Library/Preferences/or in the /ByHost folders and see if there is a com.apple.screensaver type of file there.

Since the same thing happened in a new local admin account, maybe they pushed a locked preference out with the new user template. To check that, use the terminal as root to look in /System/Library/User Template/English.lproj/Library/Preferences