Toggle "ask for password after screensaver/sleep" or the delay in 10.7 using terminal

Question

There's an option in the preference panel to change the time the mac is able to be in sleep/screensaver before requiring a password to be unlocked again.

I'm using OS X Lion 10.7.

Is there any way to change this setting using the terminal or an applescript? I tried to change the plist file using:

defaults write com.apple.screensaver askForPasswordDelay -int 60

also tried

defaults write com.apple.screensaver askForPasswordDelay -float 60

also completely disabling the password didnt work either

defaults write com.apple.screensaver askForPassword -int 0

The plist file was changed, but it had no effects at all. It's the same plist file that gets changed when manually switching the setting in the preferences.

Would be awesome if anyone got an idea how to fix my problem.

EDIT: also tried to: 1) add -currentHost flag 2) drop the -int / -float

Solution 1

You can do this using UI scripting. This requires enabled support for assistive devices in Universal Access preference pane. You can launch the script from the command line using osascript, but you need to have a GUI session for this to work.

Based on my older answer here, I created the following script which works on my File Vault enabled Lion. Apparently, a checkbox to disable the password altogether was removed, either by Lion itself or me enabling File Vault 2. In the latter case I cannot fix the script for you, but the linked one might work.

Change the index (6) of the menu item to click in the 9th line to select which of the options to choose.

---

tell application "System Preferences"
    set current pane to pane id "com.apple.preference.security"
    tell application "System Events"
        tell process "System Preferences"
            tell first window
                tell first tab group
                    click radio button 1
                    click pop up button 1
                    click menu item 6 of menu of pop up button 1
                end tell
            end tell
        end tell
    end tell
    quit
end tell

---

The following is the "official" method of changing this setting in AppleScript:

tell application "System Events" to set require password to wake of security preferences to false

It has two major problems:

• It's boolean (you cannot change the grace period)
• It doesn't work for me (it takes the place of the checkbox I don't have)

Solution 2

Try using the -currentHost option to the defaults command.

defaults -currentHost read com.apple.screensaver

defaults -currentHost write com.apple.screensaver askForPasswordDelay -int 60

In addition to the defaults command there's also /usr/libexec/PlistBuddy:

/usr/libexec/PlistBuddy -h

for f in ~/Library/Preferences/ByHost/com.apple.screensaver.*.plist; do
   /usr/libexec/PlistBuddy -c Print "$f"
done

Solution 3

The lockfile makes this a lot harder than it used to be. Easiest way I've found so far:

Execute your changes against the plist file as opposed to the domain, and execute as the superuser. This will alter the permissions on the file so that only root can read and write, which is bad and needs to be fixed. Quick chown+chmod to correct. If you don't fix permissions the next time System Preferences tries to load the plist it will fail, decide it was corrupt anyway and replace it with a default copy.

So the code is:

sudo defaults write ~/Library/Preferences/com.apple.screensaver.plist askForPasswordDelay -int 60

sudo chown <username> ~/Library/Preferences/com.apple.screensaver.plist

sudo chmod 600 ~/Library/Preferences/com.apple.screensaver.plist

This seems to apply to most of the preference files in Lion, but not all.

Solution 4

You'll have to change the version number of the config and delete the lock-file as well

defaults -currentHost write com.apple.screensaver askForPasswordDelay -int 60
defaults -currentHost write com.apple.screensaver PrefsVersion -int 101

rm ~/Library/Preferences/ByHost/com.apple.screensaver.plist.lock

I did not find the correct process to kill, but after rebooting the delay woked for me.

View more solutions

Comments

[user3333603]

Maybe deleting the lockfile would help. I'm not exactly sure what the lockfile's are but I haven't seen them before.

[desbo]

Tried deleting the .lockfile too (also the .lockfile in /ByHost). Didn't change anything, still not working.

[HikeMike]

possible duplicate of Change Mac "Ask for password after screensaver" delay

[desbo]

thanks for the link, already checked that one though. running snow leopard the seems to have worked. sadly it won't work on lion (at least for me)

[bmike]

It's not at all an answer, but I've given up on trying to cope with changing settings under these security settings (perhaps Apple intentionally makes it hard to disable this - security by obsfucation and constant change). I just use FastScripts/AutoMator to instantly lock the screen by calling /System/Library/CoreServices/Menu\ Extras/User.menu/Contents/Resources/CGSession -suspend

[desbo]

the keys are correct, i checked that. the changes i'm doing to that file using the terminal seem to be correct, i even checked the md5 sum after editing the file by terminal and preferences, they do match.

[mbrownnyc]

Do you know that these values are valid and being read by the program? Did you use the GUI to locate these values before you set them? Setting values is always cool. When they do nothing, they do nothing.

[desbo]

yeah the values i submitted are valid. first of i checked the values after using the pref panel. i even checked if the md5 sum does match when i change the value using the terminal with the md5 sum when changing a value using the pref panel.

[mbrownnyc]

I didn't mean the values, per se, but the actual data fields... md5 sums aside, do you know that the properties askForPasswordDelay and askForPassword are being read by the screensaver program itself? Since it's not working, I'd think not. File system activity is easy to monitor. API hooking (to see what the innards of the data files being read are) is much more difficult. On Windows boxes, I use rohitab's APIMonitor.

[desbo]

If i understood you correctly you are talking about debugging the screensaver program. This is out of my skill range. I tried to look at the files being accessed by the preference panel using the activity monitor. By now i actually think there might be something bugged with the whole screensaver password thing in lion. Other people seem to experience problems too like mentioned here

[mbrownnyc]

Yes, pretty much. I just hopped over to irc://irc.freenode.net/centos-social and picked those guys's brains about identifying true text from a file. I came out with ltrace, which in turn is dtrace on OSX. This thread specifies the use of dapptrace. Hopefully one of these will help you tell if the screensaver app is even looking at the plist file for that value.

[desbo]

I checked the screensavers process using the dtruss command and near the end of the log (i guess when i wanted to disable it) the process was reading the file like suspected. here is a pic of what it did output, i dont know much about reverse engineering though so i'm not quite sure if what i just said is correct

[mbrownnyc]

Hah... well, I try to "know much about reverse engineering..." so that looks like it reads the exact value. Why it's not being processed, I'm unsure. I just thought of how critical this could be from a security standpoint, so I suggest you raise a ticket with Apple. Sorry I couldn't be of any more help.

[desbo]

already tried running the command with the -currentHost option, didn't work either though. also tried to use plistbuddy which sadly didn't change anything.

[bmike]

This has got to be one of the hardest things to remember (using -currentHost) to let the system decide where a pref is stored... I don't know why that isn't the default for defaults.

[HikeMike]

Why do you execute chmod 755? When changing in System Preferences, the file is made 600.

[wlarro]

Mostly I was too lazy to check the normal permissions on the plist files when 755 worked: ) Nice catch though, corrected my previous post.

[HikeMike]

This answer still does not work. Try it: Select 1 hour in System Preferences, set it to 0 ("immediately") using your method, and press Ctrl-Shift-Eject to put the display into sleep. Wait 5 seconds, press a key. No password.

[wlarro]

Double checked it again, it continues to work perfectly for me. Any chance you're not substituting your username for <username> in the chown command?

[HikeMike]

I need to type <username> verbatim?

[Ivangrx]

How are you sure that it's not simply the rebooting that did the trick? Loginwindow handles the screen saver stuff and it's a big ball of nasty that always gets these sorts of bugs, like not reading plist files after login.

[Thanatos]

This answer, for me, successfully changes the setting that appears in System Preferences → Security & Privacy. (for me, it now reads "immediately"). It does not however, effect the actual screensaver. (i.e., despite my setting being "Require password immediately after sleep or screen saver begins", the screen saver can be active for several seconds, but moving the mouse unlocks the screen.)

[HappyFace]

This no longer works in High Sierra. 268:288: execution error: System Events got an error: Can’t get tab group 1 of window 1 of process "System Preferences". Invalid index. (-1719) If I open System Prefs myself, the script will exit without error but it still sometimes does not work. (I could change immediately to 1 hour, but I couldn't change it back.)

[HikeMike]

@HappyFace This script assumes a specific layout of the window, so if the UI changed, UI scripting necessarily breaks. There should be tools that let you explore the UI structure of windows, so you can adjust the script accordingly.