I don't think there's any built in config profile type stuff that would do what you're looking for with this. You'll likely need to script something and have it fired off with LaunchAgent or LaunchDaemon to display the message at ~10 minutes before logout. It may never be 100% accurate, but you can probably get it close.
The first step would be to get the idle time of the Mac. This can be done in the following way:
ioreg -c IOHIDSystem | awk '/HIDIdleTime/{print int($NF/1000000000); exit}'
This prints back the idle time in seconds. If you want to test the above, you can add in a sleep command before it, but the sleep value must slightly exceed the value you're expecting to see because of how it only gets whole integers. For example, to sleep for 3 seconds, and then print "3" as a result, you have to add a sleep of 3.1 seconds, so it's slightly over the value. The command above only prints whole integers.
$ sleep 3.1; ioreg -c IOHIDSystem | awk '/HIDIdleTime/{print int($NF/1000000000); exit}'
$ 3
With that, you could look at developing a LaunchDaemon that runs a script at the very least every 10 seconds (no less than that) which gets the idle time and calculates if it's at or above 10 minutes, and then display a message. Here's a script that could do this.
#!/bin/bash
## Set the minutes idle to check value here
minVal="10"
## Get the minVal in seconds
secVal=$((minVal*60))
## Path to jamfHelper
jhPath="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper"
## Get the idle time of the Mac in seconds
idleSecs=$(/usr/sbin/ioreg -c IOHIDSystem | /usr/bin/awk '/HIDIdleTime/{print int($NF/1000000000); exit}')
if [[ "$idleSecs" -ge "$secVal" ]]; then
## First check to make sure someone is logged in
if [[ $(/usr/bin/stat -f%Su /dev/console) != "root" ]]; then
## Display message to logged in user
"$jhPath" -windowType utility -title "" -heading "" -description "Your Mac has been idle for $minVal minutes. If there is no activity in another $minVal minutes, this account will be automatically logged out." -icon "/System/Library/CoreServices/loginwindow.app/Contents/Resources/LogOut.tiff" -button1 "OK" -defaultButton 1
else
echo "No user logged in. Nothing to display."
exit 0
fi
else
echo "Idle time not reached. Exiting"
exit 0
fi
And here's an example LaunchDaemon that would fire this off every 10 seconds. In practice, I would probably increase the time to about 30 seconds at a minimum. It's not a great idea to be running scripts every 10 seconds on your machines, plus launchd is very picky about jobs running any more than every 10 seconds. If it happens to run sooner it will pipe errors into the system.log and may even end up disabling the job if it thinks its gone awry.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.org.idletimecheck</string>
<key>Program</key>
<string>/path/to/idletimescript.sh</string>
<key>RunAtLoad</key>
<true/>
<key>StartInterval</key>
<integer>10</integer>
</dict>
</plist>
In the above, you'd need to change the /path/to/idletimescript.sh for the Program line to match where you saved the script on the local system.
The above items can be packaged up in their specific locations and then deployed in a pkg to the machines. You may also consider adding in a postinstall script to the package to load the LaunchDaemon right away or else it won't be active until after the first restart.
All this being said, there may be other more developed toolsets that can help with this. For example, you can look at crankd, which may have the ability to run jobs/scripts on set idle time and other events. I know it can trigger on network events and other stuff, but not completely sure if it handles idle time.
Hope that helps.
