I use a single Configuration Profile within CasperSuite to:
- Activate screen saver when idle 300 seconds.
- Ask for a password upon activity.

CasperSuite did not have a builtin configuration profile for this, so I used custom settings.
- Preference Domain: com.apple.screensaver
- Property List File: {askForPassword=1, askForPasswordDelay=0.0, idleTime=300}

I also used the builtin configuration profile to manage Energy Saver (sleep).

Thanks. I had the preference domain set to com.apple.screensaver.plist, just changed it to com.apple.screensaver I think that may have done the trick. I edited the screensaver file in the byhost folder and used it as a custom settings. See my property list file below.. am I doing it wrong? Would you be able to show me what's inside your plist file?

{PrefsVersion=100, tokenRemovalAction=0, idleTime=1200, CleanExit=YES, moduleDict={moduleName=Computer Name, path=/System/Library/Frameworks/ScreenSaver.framework/Resources/Computer Name.saver, type=0, displayName=Computer Name}}

So I think this may help you. I have figured out how to do this with Apple Scripting. I have tested it and it works really well for me. I tried the config and mcx route and I got mixed results.

Tell application "System Events" to set delay interval of screen saver preferences to 1200
tell application "System Events to set require password to wake of security preferences to true

I run this as a bash script thats executed as the user like so:

currentUser=$(stat -f%Su /dev/console)
sudo -u $currentUser -i /usr/bin/osascript<<EOF
Tell application "System Events" to set delay interval of screen saver preferences to 1200
tell application "System Events to set require password to wake of security preferences to true
EOF

In response to @brandobot post, "What is in my plist?"

I copied the plist file from my account, but first opened it in PListEdit Pro. I deleted all contents of the file except the three items list above.

@bbot You can create a Configuration Policy from JSS to start a screen saver after X amount of time (Configuration Policies > Login Window). You can then setup a separate Configuration Policy to require a password after screen saver starts (Configuration Policies > Security and Privacy).

You might want to restrict these settings (Configuration Policies> Restrictions> Preferences Tab) in System Preferences so users don't try to make modifications.

I wrote a simple script (https://github.com/tmhoule/ScreenSaverManagement) which allows the user to change the setting, but bumps to back down to be within policy if they go too high with it.