com.apple.screensaver.ByHost & Mountain Lion

[golbiga]

So I've noticed that MCX for com.apple.screensaver.ByHost is not working properly in 10.8. In 10.6 & 10.7 I have the idle time set to 600seconds & module name set to flurry. I'm noticing on 10.8 machines this is not being enforced. If I can't get the MCX to apply, I guess I will start looking at using mcxToProfile as Command Profiles by default don't seem to allow you to set ByHost Prefs. Anyone else seeing this? If so, how are you getting around it?

[nkalister]

I'm using a combination of a script and a configuration profile.
The profile sets the password prompt and the script sets the idle time.
Here's the script, it does prevent the end user from changing the idle time:

#!/bin/sh

dscl . -mcxset /Computers/localhost com.apple.screensaver idleTime always -int 900

And the configuration profile uses a custom payload:
Preference Domain: com.apple.screensaver
Property List Values:
askForPassword:Number:1
asKForPasswordDelay:Number:0

You should be able to add the mcx values you used to set the module to Flurry to the configuration profile.

[golbiga]

Should the configuration profile be at the Computer or User level?

[tkimpton]

Mcxtoprofile user level :)

[stevewood]

Funny, I'm working with screensaver right now myself, and I'm not getting the MCX to work. I'm pushing the module path via com.apple.screensaver.ByHost set to user level at every login, and yet the pref is not taking.

If I list out the plist in /Users/<user>/Library/Preferences/ByHost I see where it has added the module path, but the previous path is in there as well:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>idleTime</key>
    <integer>900</integer>
    <key>moduleDict</key>
    <dict>
        <key>moduleName</key>
        <string>Random</string>
        <key>path</key>
        <string>/System/Library/Screen Savers/Random.saver</string>
        <key>type</key>
        <integer>8</integer>
    </dict>
    <key>modulePath</key>
    <string>/Library/Screen Savers/5Planks.slideSaver</string>
</dict>
</plist>

Any thoughts as to why this is not taking? Or how to get rid of the previous entries so that this works? I know I could go the route of a bash script and delete the file first and then push the MCX, but I really was hoping to avoid that.

These are 10.6 and 10.7 hosts.

[stevewood]

Nevermind....I guess I should look closer before I post. This was a PEBKAC error on my part.

I was putting the path in, but not declaring the module name. Duh!

[golbiga]

Yeah I think I'm going with mcxToProfile at user level for both the ask for password and idletime. I'll just install both profiles at firstboot.

[golbiga]

Tim, did you upload the profiles that you created with mcxtoprofile or are you installing locally from command line?

Also, If I were to go with user level, whats the best way to ensure that the profiles get applied on first login (policy per user?) Is there any downside to installing at system level so it's applied to all users?

Thanks
Allen

[tkimpton]

Hi Allen

I have tested out thoroughly Config Profiles. I'm still testing things out (when I'm not doing 1st, 2nd and 3rd line!) I definately set it to user level.

I would think set the screen saver to something different with weird idle time when the machine has no profiles, then enroll it and see if it takes effect.

[golbiga · Accepted solution]

Looks like this was a bug in 8.6. I updated to 8.62 this morning and now MCX is being applied properly to the 10.8 machines.

[nessts]

ok i have tried the command line mcx command to set idleTime, and proflies created from profile manager, and from mcxToProfile.py and none of these manage the idleTimeout, the require lock immediately part is working wonderfully though. anybody have any additional pointers that know the 15 minutes cannot be changed by preference pane.

[bentoms]

Try: http://macmule.com/2010/11/19/how-to-set-osxs-screen-saver-via-script/

[nessts]

so essentially what you are saying is the Profiles and MCX cannot do it correct? And thanks for posting the new link to that bentoms, every other link i have found recently went to a page not found for me the last few days.

[bentoms]

No worries & yes. I had trouble with trying some of the settings via Config Profiles &/or MCX.

BUT, I just remembered our Screen Saver requirements changed & now we just use MCX on our 10.8 clients.

Here is what we use:

Delete MCX Setting Confirmation Display Name: Idle Time Application Domain: com.apple.screensaver.ByHost Key Name: idleTime Key Type: integer Key Value: 600

[bentoms]

If my memory serves me, idleTime worked.. But not all of the options in my script. Hence the script.

[nessts]

Well thanks for the hints, that is what i have set in my profiles created all the different ways possible, read the bit that you have to manage the desktop preferences too to get the screensaver stuff to be managed, so i created a profile for the desktop too, and while it does change the picture to the default every reboot i can change the picture, and i can change the idleTime. And this is for my non Casper Account so i suppose i could create some MCX stuff manually, but i would sure like to not have to do MCX when its not supposed to be the way of the future. Guess i will go resurrect all my MCX Scripts and see if i can do it that way.

[bentoms]

We have not had much luck with mcxToProfile or custom profiles.

So we only use profiles if there is the option for the setting we want (VPN, Wireless, disable Gatekeeper + AirDrop etc...)

We then use MCX...

Then scripts.

Then FEU/FUT.

Played around with these things pre Xmas when was finalising our 10.8 build.

200 clients rebuilt to 10.8 over q1 & things are working well.

Maybe 10.9 will mature things on the profile side, but I wouldn't discount MCX for 10.8 yet.

[nessts]

yeah i will test on 10.9 these recent profiles and then file a bug if they dont work.

[gachowski]

Todd,

I was not able to get this working with X.9 or X.8.

This doc

https://developer.apple.com/library/ios/featuredarticles/iPhoneConfigurationProfileRef/Introduction/Introduction.html

Kinda weakly implies that idleTime is not going to work with a profile, it a reach for sure.

I plan to use maxGracePeriod for 1 min, then password required.

C

[nessts]

well here is what I did with a Profile which looked like it might work.
just add idleTime and the desired timeout value to com.apple.screensaver NOT to the com.apple.screensaver.ByHost.
you can either convert an existing plist with mcxToProfile, manually edit an existing profile or just create custom settings in the profilemanager.
With this setting the timeout button becomes greyed out and is not accessible in the screensaver menu.
I discovered this by starting to use WGM to create a new MCX file for me, and when I reviewed what it was creating it had an idleTime in the com.apple.screensaver

The only problem with this is that it never starts screensaver and only the displaysleep is still working. So i filed a bug, see if i get any feedback, which as of late seems unlikely.