High Sierra remove lock screen

[allanp81]

Has anyone come across a way to remove the lock screen option from a mac? In our busy student open access and teaching rooms we don't want them to be able to lock a mac and walk away from it for obvious reason.

We have a way of checking idle time and forcing a log off, but I'd prefer to just remove the menu item altogether instead.

[gkgold90]

Yes, I see this as a potential problem as well. Hoping for a resolution.

[kerouak]

You could:
1. Set the Preference in 'Security and Privacy' settings as you want them i.E Uncheck 'require password after x mins of activity.
2. Disable the 'Security and Privacy' System Pref via restrictions.

That should do the trick?

Gluck!

[allanp81]

@kerouak Hi thanks for the suggestion but I don't think that would do anything as the "Lock Screen" option is still there under the Apple menu in the top left of the screen.

[ctarbox]

Has anyone come up for a solution for this? I, too, am configuring for public labs and would like to remove or disable (grey out) this menu option. Currently running 10.13.4 on desktop clients.

[wesleya]

I can't find any way to disable that function. Your best option here may be between these two pieces of the Login Window payload in Configuration Profiles:

• Enable Fast User Switching - Even in an AD environment this works fairly well, and would allow extra users to login, even if someone else is logged in
• Log Out Users After - Pretty obvious what the function is here, but I'm not quite sure how it functions in combination with Fast User Switching

[Discher]

Hello!
The good folks on the Penn State MacEnterprise Mailing List helped me figure this out today.

You can remove the 'Lock Screen' button from the Apple menu with this command:
/usr/bin/defaults write /Library/Preferences/com.apple.loginwindow DisableScreenLockImmediate -bool true

I imported the plist as a custom configuration profile in Jamf and assigned it to my High Sierra labs, but you could also just create a script and add it to a policy. Works great!

[allanp81]

@Discher This is brilliant if it works! It's another perfect example of Apple not "getting" education at all. You could enable the lock screen before but none of our students ever worked out how to but giving them a button was plain stupid as it meant we would have to implement some sort of idle logout (which we may still do anyway).

I will give this a go tomorrow.

[allanp81]

@Discher This works!!! Thanks so much.

[ctarbox]

Yes, this worked perfectly for me also! Big load off my mind knowing the students in the labs can't lock the screen. I'm hoping to do the same thing (disable) the Shut Down menu item for our Lecture Halls, as it has been a standing request for these desktops.

Cheryl

[criebrie2]

@ctarbox

This might work for you:

https://github.com/rtrouton/profiles/tree/master/ShutdownRemovedFromAppleMenu

@Discher

Could I take a look to see what the config profile looks like?

[ctarbox]

@criebrie2 Thanks for the link to the script. I opted to create a Policy with this command: /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow DisableScreenLockImmediate -bool true, as @Discher posted above. Both this Policy and the Config Profile with the Finder Payload (Commands) to Hide the ShutDown option are working well for me.

[psalgado]

Hi

According to the command shared by Discher I updated the com.apple.loginwindow and with it with the help of mcxtoprofile I made this profile
High Sierra and Mojave

Anula bloqueo de pantalla

[tx-wolf]

Our school will be moving to Mojave in the summer-to-fall timeframe. I just tried to use this on a Mojave installation and it did not work, is there a similar way to accomplish this on Mojave?

[allanp81]

@tx-wolf Are you sure? I've just tested it on Mojave and it successfully removes the lock option from the Apple menu.

[psalgado]

@tx-wolf try with this profile, I have it installed in High Sierra and Mojave

Anula e impide bloqueo de pantalla.mobilconfig

[tx-wolf]

Well it took me a while to get back to this (other things happening)....turns out I was both wrong and right. The defaults write command DOES work, but only after the machine in enrolled to JAMF. Doing the command on a machine before it is enrolled (which is what I had tried previously) has no effect. I tested today and confirmed that if I do the defaults write command post-enroll, it works very well.