Help needed with EA to gather screensaver "askForPassword" status

[carlo_anselmi]

Hello everyone,
I would need a little help from the scripting gurus out there to create an Extension Attribute to gather screensaver's "askForPassword" status in inventory for 10.10.x/10.11.x clients.
The below works for "IdleTime" but not for "askForPassword"... (The domain/default pair of (/Users/username/Library/Preferences/ByHost/com.apple.screensaver, askForPassword) does not exist)

#!/bin/sh
CONSOLE_USER_NAME="$(/usr/bin/stat -f "%Su" /dev/console)"
idleTime=`sudo -u $CONSOLE_USER_NAME defaults -currentHost read com.apple.screensaver idleTime`
echo "<result>$idleTime</result>"

although

defaults read com.apple.screensaver askForPassword

works locally from Terminal and as an ARD unix command sent as the logged user
What am I missing?
Many thanks for your help!
Carlo

[bpavlov]

#!/bin/sh
CONSOLE_USER_NAME="$(/usr/bin/stat -f "%Su" /dev/console)"
result=$(defaults read /Users/"$CONSOLE_USER_NAME"/Library/Preferences/com.apple.screensaver askForPassword)
echo "<result>$result</result>"

[bentoms]

@carlo.anselmi how is this setting being set, a profile?

[bentoms]

The reason I asked the above, is that what @bpavlov posted is valid if you've used defaults to set the settings.

However, if using a profile.. defaults will not pick that up.

As an example, the below is the output for me from @bpavlov's script:

<result>0</result>

But if I look at my Mac I can see it enforced:

defaults is not profiles aware, unless it's an MCX set-once profile (afaik - some testing to be done on this).

However, CFPreferences is:

#!/usr/bin/python

import CoreFoundation

domain = 'com.apple.screensaver'
key = 'askForPassword'

key_value = CoreFoundation.CFPreferencesCopyAppValue(key, domain)
print 'Key Value = ', key_value

key_forced = CoreFoundation.CFPreferencesAppValueIsForced(key, domain) 
print 'Key Forced = ', key_forced

This then returns:

Key Value =  True
Key Forced =  True

With the 1st being the value of the key, & the 2nd whether or not it's being enforced via a profile.

[carlo_anselmi]

Hello and many thanks for your responses...
@bentoms
Screensaver password/idle time are set with a custom profile, as per this article http://www.johnkitzmiller.com/blog/security-privacy-configuration-profile-bug-in-casper-9-82/
It seems that using @bpavlov suggestion reports correctly in JSS inventory but I'll double check on the client side...
Thank you all again!

[bpavlov]

I would go with the recommendation by @bentoms if you're using a configuration profile.

[carlo_anselmi]

Sorry, correct link
http://www.johnkitzmiller.com/blog/security-privacy-configuration-profile-bug-in-casper-9-82/

[Michael_Meyers]

Does anyone know if this issue has been corrected in Casper 9.91? Or, is there a way to allow users to pick their own settings for the screensaver in the solution from John Kitzmiller?

[jhbush]

@macmule interesting my EA returns. I wonder why you get True : True

Key Value =  1
Key Forced =  True
<result>1 : True</result>

[bentoms]

@jhbush1973 I probably messed about with something. :)

[sean]

@jhbush1973 Yours is probably set as an INT (or a STRING)

@bentoms Yours is probably a BOOL

[amosdeane]

Hi there,

I'm trying to update the above to run on Monterey via Python3 but am getting the error:

ModuleNotFoundError: No module named 'CoreFoundation'

I've tried setting the path to the module (which from what I can see is present) and also setting it via find_library but this is not working. 

I ideally want this to run without having to install anything else, if possible. If anyone has any suggestions I'd be very grateful.

#!/usr/bin/python3

import os
from ctypes.util import find_library


pathCoreFoundation = "/System/Library/Frameworks/CoreFoundation.framework/Versions/Current/CoreFoundation"
os.path.exists(pathCoreFoundation)

CoreFoundation = find_library(pathCoreFoundation)
print("The library I am importing is:", CoreFoundation)

import CoreFoundation

domain = 'com.apple.screensaver'
key = 'askForPassword'

key_value = CoreFoundation.CFPreferencesCopyAppValue(key, domain)
print ('Key Value = ', key_value)

key_forced = CoreFoundation.CFPreferencesAppValueIsForced(key, domain) 
print ('Key Forced = ', key_forced)