0

I admin a bunch of Macs, and depend on unlocking user's screen saver as admin. I've always done this editing /etc/pam.d/screensaver

This no longer works. I need to do it via security authorizationdb.

I can do it with this command:

security authorizationdb write system.login.screensaver "authenticate-session-owner-or-admin"

This works ok, but then it shows a really clunky fake-looking dialog box for users every time they want to stop their screen saver.

What I want is to keep the traits defined by this string:

<string>use-login-window-ui</string>

but open it to admin.

Has anyone else had any luck (or interest) in doing this?

default rule:

$security authorizationdb read system.login.screensaver
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict>
    <key>class</key>
    <string>rule</string>
    <key>comment</key>
    <string>The owner or any administrator can unlock the screensaver, set rule to "authenticate-session-owner-or-admin" to enable SecurityAgent.</string>
    <key>created</key>
    <real>472414282.07143301</real>
    <key>modified</key>
    <real>472414282.07143301</real>
    <key>rule</key>
    <array>
        <string>use-login-window-ui</string>
    </array>
    <key>version</key>
    <integer>1</integer> </dict> </plist>

command:

security authorizationdb write system.login.screensaver "authenticate-session-owner-or-admin"

changed rule:

$security authorizationdb read system.login.screensaver
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict>
    <key>class</key>
    <string>rule</string>
    <key>created</key>
    <real>472414282.07143301</real>
    <key>modified</key>
    <real>498674468.80855602</real>
    <key>rule</key>
    <array>
        <string>authenticate-session-owner-or-admin</string>
    </array>
    <key>version</key>
    <integer>0</integer> </dict> </plist>
Improve this question
2
  • I'd love to figure this out as well. After option-return, the OS deletes anything I try to type For me, I don't want "admin," as most users have admin privileges, so other than "self" I only want "root" permission to unlock screensaver. My previous edit to the last two lines of screensaver was - account required pam_group.so no_warn group=wheel fail_safe account required pam_group.so no_warn deny group=wheel ruser fail_safe I used this ever since Mavericks, and need it to work in Sierra, as you do!
    – Danny Caccavo
    Oct 21 '16 at 21:47
  • yes, using the pam made a mess of things in sierra -- i get the same deleting all characters action, and effectively locking one out. from what i read, the pam trick was already deprecated and is just broken now.
    – neuralstatic
    Oct 24 '16 at 16:13

You must log in to answer this question.

Browse other questions tagged .