I admin a bunch of Macs, and depend on unlocking user's screen saver as admin. I've always done this editing /etc/pam.d/screensaver
This no longer works. I need to do it via security authorizationdb.
I can do it with this command:
security authorizationdb write system.login.screensaver "authenticate-session-owner-or-admin"
This works ok, but then it shows a really clunky fake-looking dialog box for users every time they want to stop their screen saver.
What I want is to keep the traits defined by this string:
<string>use-login-window-ui</string>
but open it to admin.
Has anyone else had any luck (or interest) in doing this?
default rule:
$security authorizationdb read system.login.screensaver
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict>
<key>class</key>
<string>rule</string>
<key>comment</key>
<string>The owner or any administrator can unlock the screensaver, set rule to "authenticate-session-owner-or-admin" to enable SecurityAgent.</string>
<key>created</key>
<real>472414282.07143301</real>
<key>modified</key>
<real>472414282.07143301</real>
<key>rule</key>
<array>
<string>use-login-window-ui</string>
</array>
<key>version</key>
<integer>1</integer> </dict> </plist>
command:
security authorizationdb write system.login.screensaver "authenticate-session-owner-or-admin"
changed rule:
$security authorizationdb read system.login.screensaver
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict>
<key>class</key>
<string>rule</string>
<key>created</key>
<real>472414282.07143301</real>
<key>modified</key>
<real>498674468.80855602</real>
<key>rule</key>
<array>
<string>authenticate-session-owner-or-admin</string>
</array>
<key>version</key>
<integer>0</integer> </dict> </plist>