Script or policy to check Screen Saver time.

The following terminal command will give you the idle time against the current user

defaults -currentHost read com.apple.screensaver idleTime

Gives me the following output (in seconds)

300

Then you can change the idle time using the following

defaults -currentHost write com.apple.screensaver idleTime 600

Another option is to create a Configuration Profile that sets the screensaver and allocate it to a smart group (lab of computers, for example)

Hope that helps!

Here is a simple Extension Attribute I am using to report compliance. It can easily be adjusted to report the specific result rather than a Pass/Fail.

user=$( ls -la /dev/console | cut -d " " -f 4 )

RESULT=$(sudo -u $user defaults -currentHost read com.apple.screensaver idleTime)

# Print out PASS/FAIL
if [ $RESULT -lt 900 ] 
then
    echo "<result>Pass (ScreenSaver time out is less than 15 mins)</result>
";
else
    echo "<result>Fail (ScreenSaver time out is 15 mins or more)</result>
";
fi

FYI that plist will not always be populated. It's not for us because we use a config profile to set this value. I took this extension attribute code from another post:

#!/usr/bin/python

# EA to check the inactivity interval for the screen saver.
# This will return the number of seconds, which you can scope a smart group from.

import CoreFoundation
domain = 'com.apple.screensaver'
key = 'idleTime'

key_value = CoreFoundation.CFPreferencesCopyAppValue(key, domain)

print "<result>%s</result>" % key_value

Actually, they clarified and said we didn't need an actual check. Just to make sure our computers require a password immediately after the screen saver and to set a screen saver time across the board. Either so the user can't change it, or checked once a day to change back to 15 minutes and immediate password required. I'm thinking a configuration profile with the login window option of screensaver time set would do it, but I saw that people were having issues getting the actual time of inactivity to stick unless it was one of the apple defaults?

Here is another version