Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I've recently been given the task of securing a small network. One of the things we want to have happen is to have the computers lock down after a period of inactivity.

The easy thing for this, of course, is to require a password after the computer goes to sleep or the screen saver starts. The only problem is that I have users unchecking this, as it's a user preference (they don't need to authenticate as an admin to turn it off).

I know I can log them out after a period of inactivity, but that closes all files and programs and is a bit more of a pain for everyone. If I could just have the password prompt all the time, we'd be satisfied.

Is there a way to make the user preference "require password to wake computer from sleep or screen saver" only editable to an admin account?

The clients in question are using 10.5.8.

Thank you for any help you can provide.

share|improve this question
    
I don't understand your problem. When our users leave their computer on for 3 minutes without action, it changes to the login screen. When you enter your credentials, the users desktop and applications return as they were, when the mac switched to the login screen. I don't understand the unchecking problem, where do they uncheck what ?! What is the final task you wan't to accomplish ? –  1amtoo1337 Mar 19 '12 at 16:46
    
The password on screen saver/sleep can be turned off by the user under the security preference pane without any sort of elevated privileges. I want to ensure it remains enabled and NOT allow the user to turn it off (without admin privileges). –  user955664 Mar 19 '12 at 16:50
    
Yes you're right it's user configurable but I think you can restrict it by setting it as User Level Enforced. Check this link jamfnation.jamfsoftware.com/discussion.html?id=3117 and as far as your question goes I was not saying that it weren't a valid question. I don't get it why people over here a re so defensive, I was just trying to understand your problem. –  1amtoo1337 Mar 19 '12 at 16:54
    
We're "defensive" about maintaining the quality of answers. You posted a request for clarification as an answer. That's not the way things work here. –  jaberg Mar 19 '12 at 17:13
    
Wasn't being defensive at all, just answering your question to the question. Emphasis was for clarity only. –  user955664 Mar 19 '12 at 18:40
add comment

1 Answer

Although I have concerns about recommending this solution, you can change the access permissions for the Security (or Security & Privacy) preferences pane itself so that only the Administrator account, or members of the Administrator group, will be able to open that pane.
[ᔥ Owen Linzmayer: Require Password to Wake 2005]

I want to emphasize that I have not fully tested this solution and that you should proceed with caution and do your own testing before implementing it across an entire production environment. It seems innocuous enough, but experience has taught me that changes in places that Apple does not intend you control can sometimes have consequences.

You can set permissions for the pane using the terminal, or by navigating to the /System/Library/PreferencePanes folder:

image of Go to Folder dialog box

Selecting the Security pane file:

image of contents of PreferencePanes folder

do a Get Info using the menu, contextual menu or + i and change the permissions for everyone to no access. You will most likely have to click the lock in the lower-right-hand corner and authenticate with your administrator password before you can edit the permissions.

image of Get Info for Security PrefPane

share|improve this answer
    
This looks like it might work. A repair permissions would probably reset it, but I'm not sure anyone here would go through that trouble. I'd prefer to let them see (but not change) the preference pane versus an error, but this looks like a good alternative if I can't find out how to do it any other way. –  user955664 Mar 19 '12 at 18:42
    
I agree, it wouldn't be my first choice either. But we have to work with the toolbox we're given. Keep us posted! –  jaberg Mar 19 '12 at 18:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.