Fleet | Lock screen after inactivity of 20 minutes or less

Controls and policies/

Lock screen after inactivity of 20 minutes or less

Guillaume Ross

Checks that a mobile device management (MDM) solution configures the Mac to lock the screen after 20 minutes or less.

Control

Create or edit a configuration profile with the following information:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadDisplayName</key>
      <string>Screensaver</string>
      <key>PayloadIdentifier</key>
      <string>com.apple.screensaver.FDC5E74E-C09E-484C-B3F3-FF04BF8AF9AB</string>
      <key>PayloadType</key>
      <string>com.apple.screensaver</string>
      <key>PayloadUUID</key>
      <string>FDC5E74E-C09E-484C-B3F3-FF04BF8AF9AB</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
      <key>askForPassword</key>
      <true/>
      <key>askForPasswordDelay</key>
      <integer>60</integer>
      <key>idleTime</key>
      <integer>1140</integer>
    </dict>
  </array>
  <key>PayloadDisplayName</key>
  <string>Lock screen after inactivity of 20 minutes</string>
  <key>PayloadIdentifier</key>
  <string>com.fleetdm.lockScreenAfter20Minutes.34DD0263-156C-48DB-B6B8-64D3112A1128</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>34DD0263-156C-48DB-B6B8-64D3112A1128</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

Create or edit the following script and configure it to run when the check fails:

Check

Use the policy below to verify

SELECT 1 WHERE EXISTS (SELECT CAST(value as integer(4)) valueint from managed_policies WHERE domain = 'com.apple.screensaver' AND name = 'askForPasswordDelay' AND valueint <= 60 LIMIT 1) AND EXISTS (SELECT CAST(value as integer(4)) valueint from managed_policies WHERE domain = 'com.apple.screensaver' AND name = 'idleTime' AND valueint <= 1140 LIMIT 1) AND EXISTS (SELECT 1 from managed_policies WHERE domain='com.apple.screensaver' AND name='askForPassword' AND value=1 LIMIT 1);

Platform

Share

Docs REST API Guides A pencil icon

Edit page

Multi platform Device management Orchestration Software management Integrations Pricing

Documentation Support Docs API Release notes Get your license

Company About News Jobs Logos/artwork Why open source?

SOC2 Type 2