2

Is there a way to disable the default behavior for macOS (10.13/10.14) of locking the screen x-amount of time after the screensaver or sleep begins?

I have some Mac Minis in a computer lab. People log in, use the computer and then walk away. MacOS locks the screen an hour later when the power settings turn off the monitor. The next user is unable to log in because the screen is locked and there is no option to enter a username for switching or any other purpose. All that's there is a password dialog. The only recourse is to forcibly reboot the Mac.

The ultimate solution would be to have an application that forcibly logs-out idle users, but there are none that I can find.

MacOS appears to have a provision for doing so, but it doesn't appear to actually do anything: If the user has any application open which prompts for a save command upon termination, the logoff will not occur, and users always have programs open that prompt for saving. If I had the skills, I would write such an application but I do not.

I've tried running: sudo defaults write com.apple.loginwindow DisableScreenLockImmediate -bool TRUE

Does nothing. There is no change. The default screenlock is still active and enabled and the Lock Screen menu choice is still available on the Apple menu.

Improve this question

3 Answers 3

Reset to default
2

Instead of writing to preferences, we must use sysadminctl to configure screen lock now.

sysadminctl -screenLock off -password <my password>

or if you'd rather have a password prompt

sysadminctl -screenLock off -password -

I tested this on macOS Catalina 10.15.7 and Big Sur 11.4

On macOS Catalina, we can only set screen lock to off or immediate:

$ sysadminctl
2021-08-23 11:00:29.685 sysadminctl[63828:9180002] Usage: sysadminctl
    -deleteUser <user name> [-secure || -keepHome] (interactive || -adminUser <administrator user name> -adminPassword <administrator password>)
    -newPassword <new password> -oldPassword <old password> [-passwordHint <password hint>]
    -resetPasswordFor <local user name> -newPassword <new password> [-passwordHint <password hint>] (interactive] || -adminUser <administrator user name> -adminPassword <administrator password>)
    -addUser <user name> [-fullName <full name>] [-UID <user ID>] [-shell <path to shell>] [-password <user password>] [-hint <user hint>] [-home <full path to home>] [-admin] [-picture <full path to user image>] (interactive] || -adminUser <administrator user name> -adminPassword <administrator password>)
    -secureTokenStatus <user name>
    -secureTokenOn <user name> -password <password> (interactive || -adminUser <administrator user name> -adminPassword <administrator password>)
    -secureTokenOff <user name> -password <password> (interactive || -adminUser <administrator user name> -adminPassword <administrator password>)
    -guestAccount <on || off || status>
    -afpGuestAccess <on || off || status>
    -smbGuestAccess <on || off || status>
    -automaticTime <on || off || status>
    -filesystem status
    -screenLock <immediate || off> -password <password>

Pass '-' instead of password in commands above to request prompt.
'-adminPassword' used mostly for scripted operation. Use '-' or 'interactive' to get the authentication string interactively. This preferred for security reasons

But on Big Sur, we can set a delay and query the screen lock status:

$ sysadminctl
2021-08-23 16:01:00.636 sysadminctl[26772:2610970] Usage: sysadminctl
    -deleteUser <user name> [-secure || -keepHome] (interactive || -adminUser <administrator user name> -adminPassword <administrator password>)
    -newPassword <new password> -oldPassword <old password> [-passwordHint <password hint>]
    -resetPasswordFor <local user name> -newPassword <new password> [-passwordHint <password hint>] (interactive] || -adminUser <administrator user name> -adminPassword <administrator password>)
    -addUser <user name> [-fullName <full name>] [-UID <user ID>] [-GID <group ID>] [-shell <path to shell>] [-password <user password>] [-hint <user hint>] [-home <full path to home>] [-admin] [-roleAccount] [-picture <full path to user image>] (interactive] || -adminUser <administrator user name> -adminPassword <administrator password>)
    -secureTokenStatus <user name>
    -secureTokenOn <user name> -password <password> (interactive || -adminUser <administrator user name> -adminPassword <administrator password>)
    -secureTokenOff <user name> -password <password> (interactive || -adminUser <administrator user name> -adminPassword <administrator password>)
    -guestAccount <on || off || status>
    -afpGuestAccess <on || off || status>
    -smbGuestAccess <on || off || status>
    -automaticTime <on || off || status>
    -filesystem status
    -screenLock <status || immediate || off || seconds> -password <password>

Pass '-' instead of password in commands above to request prompt.
'-adminPassword' used mostly for scripted operation. Use '-' or 'interactive' to get the authentication string interactively. This preferred for security reasons

    *Role accounts require name starting with _ and UID in 200-400 range.

See https://blog.kolide.com/checking-macos-screenlock-remotely-62ab056274f0 for a detailed analysis.

Improve this answer
1
  • Thank you, I've been looking for this for a few hours. Nothing has worked until I found this. Wish there was better documentation for mac terminal commands.
    – user2481095
    Oct 25, 2021 at 21:53
1

The timeout is controlled in the Security and Privacy panel in System Preferences. What you are looking for is on the General tab and sets the time before requiring a password after the screen saver kicks in.

Improve this answer
1

I have the same issue, and seems all the previous tricks no longer work on Mojave.

As to your autologout after X minutes, I believe you can still do that, with the script below (although I'm not sure I've actually tested it on Mojave). You can just push the script out using whatever method you like, and run it once. (Or you can just open a Terminal window, or ssh in, and run the command manually.)

autologoff.sh

#!/bin/bash

# I think this this turns on the feature
defaults write /Library/Preferences/.GlobalPreferences com.apple.securitypref.logoutvalue -int 1800

# and that this sets the delay
defaults write /Library/Preferences/.GlobalPreferences com.apple.autologout.AutoLogOutDelay -int 3600

# 3600 = 60 minutes
# 1200 = 20 minutes
#   750 = 12 minutes
#   600 = 10 minutes
#   500 = 8 minutes
#   etc 

# (I suspect one of these can simply be a non-zero value,
# and that the Apple OS programmers just plugged in
# the value given by the user instead of making it a
# binary 0 or 1 value, but I’m not sure.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .