Enforcing a Screen Saver with JAMF Pro on Ventura 13.4

[Dobson]

Do the 'Start Screen Saver after:' and 'Use Screen Saver Module at Path:' settings still function properly for the 'Login Window' configuration profile (JAMF Pro 10.46) in macOS Ventura? 

We attempted to apply both a custom screen saver and one of the built-in options but are not seeing any of the desired results.

Curious if I'm missing something.

[sujal1208 · Accepted solution]

I have a screensaver policy to lock the device after 10 minutes of inactivity and display the classic flurry screen saver and it works on ventura.

Bundle ID: com.apple.screensaver

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>askForPassword</key>
	<true/>
	<key>askForPasswordDelay</key>
	<integer>0</integer>
	<key>idleTime</key>
	<integer>600</integer>
	<key>loginWindowIdleTime</key>
	<integer>300</integer>
	<key>moduleName</key>
	<string>Flurry</string>
</dict>
</plist>

[efil4xiN · Accepted solution]

something did change at least for us. We do not use that setting , but the below  as a custom plist to get the computer name  as the custom display and display to activate after 20 minutes. This is working for us on Ventura:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>idleTime</key>
    <integer>1200</integer>
    <key>loginWindowIdleTime</key>
    <integer>1200</integer>
    <key>loginWindowModulePath</key>
    <string>/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex</string>
    <key>moduleName</key>
    <string>Computer Name</string>
  </dict>  
</plist>

[sujal1208 · Accepted solution]

I have a screensaver policy to lock the device after 10 minutes of inactivity and display the classic flurry screen saver and it works on ventura.

Bundle ID: com.apple.screensaver

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>askForPassword</key>
	<true/>
	<key>askForPasswordDelay</key>
	<integer>0</integer>
	<key>idleTime</key>
	<integer>600</integer>
	<key>loginWindowIdleTime</key>
	<integer>300</integer>
	<key>moduleName</key>
	<string>Flurry</string>
</dict>
</plist>

[efil4xiN · Accepted solution]

something did change at least for us. We do not use that setting , but the below  as a custom plist to get the computer name  as the custom display and display to activate after 20 minutes. This is working for us on Ventura:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>idleTime</key>
    <integer>1200</integer>
    <key>loginWindowIdleTime</key>
    <integer>1200</integer>
    <key>loginWindowModulePath</key>
    <string>/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex</string>
    <key>moduleName</key>
    <string>Computer Name</string>
  </dict>  
</plist>

[Dobson · Accepted solution]

for whatever reason the plist approach worked instead of the Built in JAMF one. 

We just made a quick .saver screensaver file in xcode to display a PNG, deployed it as a .pkg and pointed the plist to it - worked like a charm!

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>askForPassword</key>
	<true/>
	<key>askForPasswordDelay</key>
	<integer>0</integer>
	<key>idleTime</key>
	<integer>900</integer>
	<key>loginWindowIdleTime</key>
	<integer>600</integer>
	<key>moduleName</key>
	<string>DoctorScreenSaver</string>
</dict>
</plist>

[_CJ]

Boy, I must really be missing something obvious.  I've been trying to get a loginwindow screensaver working for ages and have never had luck.  If it's verified to be working in Ventura, I must be overlooking something.

I know that Jamf's built-in Screensaver profile doesn't work, so I've tried a couple alternatives.  First I used ProfileCreator to make a signed profile (didn't work), and second I tried really old school deploying /Library/Preferences/com.apple.screensaver.plist (long shot, but unsurprisingly didn't work).

How are everyone deploying this profile/plist?

[sujal1208]

In JAMF, I did was:

• Application and Custom Settings
  • Upload
• Preference Domain: com.apple.screensaver
• Inside the PLIST:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>askForPassword</key>
	<true/>
	<key>askForPasswordDelay</key>
	<integer>0</integer>
	<key>idleTime</key>
	<integer>600</integer>
	<key>loginWindowIdleTime</key>
	<integer>300</integer>
	<key>moduleName</key>
	<string>Flurry</string>
</dict>
</plist>

 Maybe your computer is not receiving the profile. You could always check out Low Profile to see if there is an issue with the config. Or make sure you don't have redundant configs for this. 

[_CJ]

Yup, that's exactly how I did it.  The profile is signed and everything so that it doesn't get changed by Jamf.

For testing, I set loginWindowIdleTime to 5, just so I can tell quickly whether it works or not.  But no longer how long I leave it at the login screen, the screen saver never kicks in.

Weirdly, it does kick in (after 5 seconds) on the user session if I log in.

Do only certain screen savers work on the login screen?  I'm trying to use either "Computer Name" or the one that used to be called "iLifeSlideshows".

[_CJ]

Also interestingly, when the screen saver fails to start on the login window, there is a unified log entry that says:

2023-07-26 12:51:40.069753-0700 0x77722    Error       0x0                  20299  0    lwsslauncher: (LaunchServices) [com.apple.launchservices:open] LAUNCH: request execute thru runningboard of 0x0-0xdc0dc com.apple.ScreenSaver.Engine/<private> failed with error=Error Domain=RBSRequestErrorDomain Code=5 "Launch failed." UserInfo={NSLocalizedFailureReason=Launch failed., NSUnderlyingError=0x60000196c330 {Error Domain=OSLaunchdErrorDomain Code=112 "Could not find specified domain" UserInfo={NSLocalizedFailureReason=Could not find specified domain}}}

[Abd0192]

This doesn't work on MacOS Sonoma anymore

[telus_studios]

So... that's it?

As of macOS Sonoma the login window is no longer blanked (protected from burn-in by a screensaver)?

Seems like a major oversight (from Apple) to me. Our nice iMac Pros are logged out all weekend, for power saving and burn-in protection it sure would be nice if we can get the screen to blank after 10 minutes or so.

[_CJ]

Urgh, I really hope that's not the case.

The screen burn-in thing is definitely a concern, especially in our labs where we have Wacom Cintiqs or even Apple Studio Displays.

I've never been able to get loginwindow screensavers working ever since the loginwindow was changed back in... Big Sur?  

[telus_studios]

I found Configuration Profiles > Our Computer Profile > Login Window > Options.

In there, I set:
Start screen saver after: 15min
Module: /System/Library/Screen Savers/FloatingMessage.saver

And this works! The login screen now goes to screensaver.
However, it also enforces a 15min screensaver for all users who log in, and it cannot be changed (by the user).

So "yay!" but also "doh!".

[itibsolution]

Hey,
we have a weird behaviour.
We tried the above plist without the key for the module to allow the user to change the screensaver, but not the time and password protection.
On my test-devices it works also with sonoma.
But for some users in the field, no matter what the choose, it always resets the screensaver to flurry.
Screensaver it set to 10 minutes inactivity, but the commandline gives us:

He was only able to change the scrennsaver persistent with:

defaults -currentHost write com.apple.screensaver moduleName -string "Horizont in Sonoma"