TweetFollow Us on Twitter

MacEnterprise: Screen Saver and loginwindow: Friends at Last

Volume Number: 26
Issue Number: 01
Column Tag: system administration

MacEnterprise: Screen Saver and loginwindow: Friends at Last

Using MCX to manage a new Snow Leopard feature

by Greg Neagle

Introduction

A couple of months ago, we looked at some of the new features in Snow Leopard. I noted that the screen saver now runs over the loginwindow - a feature I've asked for since 2001, when OS X was first released! But when I wrote that particular column, I had not yet discovered how to control the time before the screen saver activates, or how to specify which screen saver module runs. The answer, not surprisingly, is to use MCX - Apple's method for managing preferences. So this month, we'll look at controlling Snow Leopard's loginwindow screen saver, and along the way, talk about MCX in general. If you don't or can't use MCX in your environment, don't worry - we'll also look at a way to manage the loginwindow screen saver using the defaults command.

You may be asking yourself - why does anyone want a screen saver over the loginwindow? Even if they are worried about display "burn-in", why don't they just set the display to dim or the machine to sleep after a period of inactivity? Dimming the display or sleeping the machine might be good choices for some organizations. But in instructional labs, students gravitate towards machines that look "alive", and may assume a machine with a dark display is broken. In my environment, some of our machines are connected to color-calibrated CRT displays that must be kept "warm" to retain their calibration. Shutting down the machine or putting it to sleep causes the display to go cold and require time-consuming recalibration. In other organizations, there might be a desire to run a screen saver over the loginwindow that acts as an informational display. Also, many organizations want to leave their machines on and awake when no one is logged in so that administrative tasks can be performed in the off-hours. Whatever the reason you might need or want to run a screen saver over the Login Window, you finally have an Apple-supported method to do so. Prior to Snow Leopard, OS X administrators had to resort to all sorts of hacks and tricks to get Apple's screen saver or a pale third-party imitation to work over loginwindow.

MCX for everyone

If you aren't using MCX to manage your OS X machines, you really should be. If your machines are on Leopard or later, there's really no reason any longer not to; you don't need to have an Open Directory server; you don't need to extend your LDAPv3 or Active Directory schema. You can put your MCX management settings on the local computer using a technique referred to as Local MCX.

For more information on Local MCX, you can refer to past MacEnterprise columns in MacTech:

"MCX- No Excuses, Now!", MacTech, Volume 24, Issue 11, November 2008

http://www.mactech.com/articles/mactech/Vol.24/24.11/2411MacEnterprise-MCX-NoExcuses/index.html

"Loco for Local MCX", MacTech, Volume 25, Issue 2, February 2009

(available online in Feb, 2010)

Some additional Local MCX resources:

http://www.afp548.com/article.php?story=using-mcx-in-the-dslocal-domain

http://managingosx.wordpress.com/2008/02/07/mcx-dslocal-and-leopard/

http://www.macos.utah.edu/documentation/administration/local_mcx.html

http://homepage.mac.com/gregneagle/files/MW2009_IT803.pdf/P>

For the remainder of this column, I'll be using Local MCX to demonstrate the techniques, but they'll work with a traditional network directory-based MCX deployment as well.

Workgroup Manager

To configure the loginwindow screen saver using MCX, you'll want to use Workgroup Manager 10.6 or later. As of this writing, you can get the 10.6.2 version of the Server Administration Tools, which includes Workgroup Manager, at this URL:

http://support.apple.com/downloads/DL968/en_US/ServerAdminTools10.6.2.dmg

Open Workgroup Manager, connect to the directory service you are using (network or local), and select a Computer or Computer Group to manage. If you're following along and are trying this out, you might want to create a new computer group to experiment with; this allows you to experiment without affecting any existing computers or computer groups. When you are done experimenting, you can simply delete the computer group you created, and all your experimental detritus will be cleanly removed.

When managing the screen saver over the loginwindow, preference management must be done at the computer or computer group level. These preferences are not associated with individual users - in most cases, no user will be logged in when we're at the loginwindow, so user or group preferences would not be available.

For this column, I've created a Computer Group called loginwindowscreensaver, added my local test machine to the group, and then clicked on Preferences in the toolbar. The result is shown in Figure 1.


Figure 1 - Workgroup Manager preferences management

Click the Login preferences and select the Options tab, which should display a pane like that in Figure 2.


Figure 2 - Login preferences Options tab

At the bottom of the Options pane, you'll see the new options for managing the screen saver over loginwindow. You can set the idle time after which the screen saver starts, and specify which screen saver module runs. Make your choices, click Apply Now, and Done. That was easy! Any computers that are part of the computer group you are managing will now get these new preferences.

While this is a nice, easy-to-use interface for managing the loginwindow screen saver, in practice it can present a problem. If you use this pane, all of the settings in the pane are managed as a group. You may want to manage the loginwindow screen saver, but leave other loginwindow options alone; this interface doesn't really allow for that. If you use this interface, you cannot manage the screen saver at the loginwindow without also managing automatic login, Fast User Switching, external accounts and more. This may not be what you want. You might be looking for something a little more granular.

Editing Details

Fortunately, there is an alternate interface that gives you finer-grained control. If you refer back to Figure 1, you'll see that the Workgroup Manage preferences editor has two tabs: Overview and Details. The Login pane is available via the Overview tab. But we can get more precise control (and more options) by using the Details pane. If you are still in the Login preferences editor pane, click Done to return to the Overview, then click the Details tab. If you haven't imported any preference manifests yet, it will look something like Figure 3.


Figure 3 - Preference details

If you have previously imported some preference manifests, you will have additional entries, but that's not important right now. What we're interested in are the entries that have the gray circle with a white mouse pointer icon in the first column. These are the preferences we set as managed when using the Login pane under the Overview tab. We can now do some surgery so we are managing only the screen saver preferences.

If you examine the contents of com.apple.screensaver (as in Figure 4), you'll see that the loginWindowIdleTime and loginWindowModulePath are being managed, so you can just delete all of the other managed preferences; none of them will be managed.

Deleting .GlobalPreferences, com.apple.loginwindow, com.apple.MCX, and com.apple.systempreferences causes all of the preferences included in those domains to revert to being unmanaged. Now computers that are members of our loginwindowscreensaver group will receive managed preferences only for the com.apple.screensaver domain.


Figure 4 - com.apple.screensaver Managed Preferences

Once you've made these changes, if you go back to the Overview and look at the Login preferences you'll see all sorts of strange "half-checked" options, because the current settings no longer match anything that can be cleanly represented in the Overview interface. Once you start fine-tuning using the Details interface, you cannot use the Overview interface without erasing your detail work.

Preference Manifests

There is another way to work with Workgroup Manager, which is to use preference manifests. This method allows us to do all the work in the Details interface. If you're following along, and have taken my advice and are using a newly created computer group to test these settings, delete all of your managed preferences so you are working with a clean slate.

We'll start by adding in the new preference manifests for Snow Leopard, if you haven't already done so. In the Details preferences editor pane, click on the plus icon in the lower left. Navigate to /System/Library/CoreServices, select ManagedClient, and click Add.


Figure 5 - Imported preference manifests

You should see something similar to Figure 5. Adding ManagedClient.app imports a number of useful preference manifests, but the one we're interested in today is Screen Saver Loginwindow, or com.apple.screensaver, which should sound familiar.

Double-click Screen Saver Loginwindow. Select Always, and turn down the disclosure triangle. Click the New Key button. Click the new key's title - New Item - and select Login Window Idle Time from the pop-up menu. Click New Key again, and change the New Item to Login Window Screen Saver Module Path. The results should look like Figure 6.


Figure 6 - Screen Saver Loginwindow managed preferences

This is functionally identical to editing the "bare" com.apple.screensaver preferences, but if you use the Screen Saver Loginwindow preferences manifest, Apple gives you a little more information to work with. For the Login Window Screen Saver Module Path key, Apple has provided some info to let you know that not all screen savers will work over the loginwindow, so you must test. The Login Window Idle Time help text lets you know that setting this value to 0 disables the screen saver at the loginwindow.

Require Password

One more advantage to using the preference manifest - it can help you discover other settings that can be managed. When adding the new keys, you may have noticed another possible choice: Require Password. This key allows you to manage the setting to require a password after waking from sleep or clearing the screen saver. This is an important setting in many organizations to enforce computer security, and setting this via MCX in Leopard was tricky - Leopard's preference manifests contained only a manifest for com.apple.screensaver.ByHost, but setting Require Password there did not provide the desired result. To make things work, you needed to import preferences for com.apple.screensaver (minus the ByHost) and manage those as well. With Snow Leopard, Apple's cleaned this up so things behave as you'd expect.

Require password delay

To manage this preference, we need to discover the name of the preference key, so first we'll set it manually. Open System Preferences and choose the Security preference pane. Check Require password, and set the delay to 1 minute. Figure 7 shows the settings.


Figure 7 - Require password settings

Close System Preferences. Now we'll use the defaults command to find the name of the preference key we're looking for. We know the other key (askForPassword) is stored in com.apple.screensaver, so let's look there first:

> defaults read com.apple.screensaver
{
    askForPassword = 1;
    askForPasswordDelay = 60;
    tokenRemovalAction = 0;
}

askForPasswordDelay looks like what we need. Returning to Workgroup Manager, we can use the Screen Saver Loginwindow preference manifest to add the Require Password key. To manage the askForPasswordDelay key, just add a new key, click on its name and choose Edit. This allows us to add key names that aren't in the preferences manifest. You can type askForPasswordDelay as the name of the key. Change its type to Integer, and for the value, type the number of seconds you'd like as the delay before a password is required. When you're done, it should look like Figure 8. Note the Name doesn't match preference manifest warning - we can ignore this since we added this key intentionally.


Figure 8 - com.apple.screensaver managed preferences

Click Apply Now and Done, and log out and back in on a computer that is a member of the computer group you are testing with. If you open System Preferences and click the Security pane, you should see something like Figure 9. Note that Require password is checked, the delay is set to one minute (or whatever you set it to) and both controls are disabled, indicating to the user that they cannot change them.


Figure 9 - Managed screen saver password preferences

Other options

If you absolutely cannot or will not use MCX, even via Local MCX, all is not lost. You can still manage the screen saver over loginwindow, and can at least set a default behavior for Requires password and the delay.

To accomplish these tasks without using MCX, we can use the defaults command. To manage the screen saver over the login window (watch the line breaks - there are two commands here; each should be all on one line):

defaults write /Library/Preferences/com.apple.screensaver  
   loginWindowIdleTime -int 300
defaults write /Library/Preferences/com.apple.screensaver 
   loginWindowModulePath 
   "/System/Library/Screen Savers/Flurry.saver"

If your users don't have admin rights, this is virtually identical to using MCX to manage this, as there's no standard user-accessible way to change or override these settings.

You can also set Require password and its delay (again, two commands, each all on one line):

defaults write /Library/Preferences/com.apple.screensaver 
   askForPassword -int 1
defaults write /Library/Preferences/com.apple.screensaver 
   askForPasswordDelay -int 60

Unfortunately, for these particular settings, this is a poor substitute for MCX, as the user can override these settings with a visit to the Security pane in System Preferences. Without MCX, these controls will remain available in the Security pane, and the users may change them at will. Also, any pre-existing user preferences for the screen saver will still be applied. To come closer to enforcing these preferences, you'd have to write a script that deleted these preferences from the user's home directory so they wouldn't override the ones set in /Library/Preferences/com.apple.screensaver.plist, and also perhaps figure out a way to deny the users access to the Security preference pane. Once you start writing scripts to manage preferences that can be managed via MCX, you're better off investing the effort in getting Local MCX working.

Since these defaults settings are all stored in a single file - /Library/Preferences/com.apple.screensaver.plist - you could also use a software delivery tool like radmind or LANrev or Casper to simply install that file with the appropriate contents. Again, this would be effective for managing the screen saver over the Login Window, but less so for requiring a screen saver password.

Conclusion, and the future...

So there you have it. Apple has provided a new feature in Snow Leopard - the screen saver can now run over the Login Window. Even better, they've made sure it can be managed via MCX. We looked at several methods for specifying our managed preferences, using Apple's tools. And we also looked at a way to control the screen saver over the loginwindow even without using MCX.

Where might you go from here? If one of your goals was to manage the loginwindow screen saver so you could display a set of images that are specific to your organization - for example, artwork from your company, or images from a company event, or even advertising, you'll probably want to create your own slideSaver, and manage its preferences. But that will have to wait for another time! See you next month.


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Skim 1.4.29 - PDF reader and note-taker...
Skim is a PDF reader and note-taker for OS X. It is designed to help you read and annotate scientific papers in PDF, but is also great for viewing any PDF file. Skim includes many features and has a... Read more
FontExplorer X Pro 6.0.2 - Font manageme...
FontExplorer X Pro is optimized for professional use; it's the solution that gives you the power you need to manage all your fonts. Now you can more easily manage, activate and organize your... Read more
1Password 6.7.1 - Powerful password mana...
1Password is a password manager that uniquely brings you both security and convenience. It is the only program that provides anti-phishing protection and goes beyond password management by adding Web... Read more
Vivaldi 1.9.818.44 - An advanced browser...
Vivaldi is a browser for our friends. In 1994, two programmers started working on a web browser. Our idea was to make a really fast browser, capable of running on limited hardware, keeping in mind... Read more
Vivaldi 1.9.818.44 - An advanced browser...
Vivaldi is a browser for our friends. In 1994, two programmers started working on a web browser. Our idea was to make a really fast browser, capable of running on limited hardware, keeping in mind... Read more
Skim 1.4.29 - PDF reader and note-taker...
Skim is a PDF reader and note-taker for OS X. It is designed to help you read and annotate scientific papers in PDF, but is also great for viewing any PDF file. Skim includes many features and has a... Read more
1Password 6.7.1 - Powerful password mana...
1Password is a password manager that uniquely brings you both security and convenience. It is the only program that provides anti-phishing protection and goes beyond password management by adding Web... Read more
FontExplorer X Pro 6.0.2 - Font manageme...
FontExplorer X Pro is optimized for professional use; it's the solution that gives you the power you need to manage all your fonts. Now you can more easily manage, activate and organize your... Read more
VOX 2.8.24 - Music player that supports...
VOX just sounds better! The beauty is in its simplicity, yet behind the minimal exterior lies a powerful music player with a ton of features and support for all audio formats you should ever need.... Read more
OmniPlan 3.7.1 - Robust project manageme...
With OmniPlan, you can create logical, manageable project plans with Gantt charts, schedules, summaries, milestones, and critical paths. Break down the tasks needed to make your project a success,... Read more

Latest Forum Discussions

See All

Fire Emblem Heroes event announces new m...
As reported yesterday, Nintendo was gearing up a live press event for their popular mobile game,Fire Emblem Heroes. While the stream revealed a lot of new things, the event was entirely in Japanese. Luckily we have a rundown of what was announced... | Read more »
Best games we played this week
Another week, another slate of new mobile games. Although there weren't as many big name releases as last week, there were plenty of unique video game titles that came out that's sure to keep you interested over the weekend. Everything from classic... | Read more »
Olli by Tinrocket (Photography)
Olli by Tinrocket 1.0 Device: iOS iPhone Category: Photography Price: $2.99, Version: 1.0 (iTunes) Description: Get drawn in with Olli by TinrocketOlli instantly turns your everyday moments into hand-drawn art and animations. • Watch... | Read more »
Penarium (Games)
Penarium 1.0 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0 (iTunes) Description: | Read more »
Fire Emblem Heroes is way more profitabl...
Profits for Nintendo's mobile game Fire Emblem Heroes are apparently impressive enough to beat out other Nintendo titles likeSuper Mario Run, despite having 10 times fewer downloads. [Read more] | Read more »
Classic series Robot Unicorn Attack 3 no...
The classic Adult Swim browser game, Robot Unicorn Attack, branched off into a series of popular mobile games. Now, the latest entry into the series, Robot Unicorn Attack 3, is available for iOS and Android mobile devices. [Read more] | Read more »
Sudoku Sweeper (Games)
Sudoku Sweeper 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: A minimalist mashup of Minesweeper and Sudoku. Logic puzzle perfection. Every row, column and zone contains a bomb and one of... | Read more »
Under Leaves (Games)
Under Leaves 1.0.0 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0.0 (iTunes) Description: Journey into the forest, the jungle or the depths of the deep blue sea. Find chestnuts for the pigs, a caterpillar for the... | Read more »
Ninja Pizza Girl (Games)
Ninja Pizza Girl 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: In the not-so-distant future, rampart traffic congestion has resulted in only one way to deliver pizzas across town in thirty... | Read more »
SCRAP (Games)
SCRAP 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: That day, for no apparent reason, SCRAP decided to wake up and run. He had to, because his activation was a mistake the "Factory" could... | Read more »

Price Scanner via MacPrices.net

15-inch 2.7GHz Space Gray Touch Bar MacBook P...
B&H Photo has the 15″ 2.7GHz Space Gray Touch Bar MacBook Pro in stock today and on sale for $2599…$200 off MSRP. Shipping is free, and B&H charges NY & NJ sales tax only: - 15″ 2.7GHz... Read more
13-inch 2.9GHz/256GB Space Gray Touch Bar Mac...
B&H Photo has the 13″ 2.9GHz/256GB Space Gray Touch Bar MacBook Pro in stock today and on sale for $150 off MSRP including free shipping plus NY & NJ sales tax only: - 13″ 2.9GHz/256GB Touch... Read more
21-inch iMacs on sale for up to $151 off MSRP
B&H Photo has 21″ iMacs on sale for up to $151 off MSRP, each including free shipping plus NY sales tax only: - 21″ 3.1GHz iMac 4K: $1348 $151 off MSRP - 21″ 2.8GHz iMac: $1199.99 $100 off MSRP... Read more
Weekend deal: Up to $420 off new MacBook Pros...
Apple has Certified Refurbished 2016 15″ and 13″ MacBook Pros available for $230 to $420 off original MSRP. An Apple one-year warranty is included with each model, and shipping is free: - 15″ 2.6GHz... Read more
Price drop: 15-inch 2.2GHz Retina MacBook Pro...
Amazon has dropped their price on 15″ 2.2GHz Retina MacBook Pros (MJLQ2LL/A) to $1709.99 including free shipping. Their price is $290 off MSRP for this model. Note that stock may sell out quickly at... Read more
2.8GHz Mac mini on sale for $899, save $100
B&H Photo has the 2.8GHz Mac mini (model number MGEQ2LL/A) on sale for $899 including free shipping plus NY & NJ sales tax only. Their price is $100 off MSRP. Read more
Check Apple prices on any device with the iTr...
MacPrices is proud to offer readers a free iOS app (iPhones, iPads, & iPod touch) and Android app (Google Play and Amazon App Store) called iTracx, which allows you to glance at today’s lowest... Read more
New System Clock for macOS by B-Eng Now Avail...
Fehraltorf, Switzerland based B-Eng has announced the release and immediate availability of System Clock, the company’s new system monitor and information app developed exclusively for macOS. System... Read more
DEVONtechnologies Celebrates 15th Anniversary...
DEVONtechnologies celebrates its 15th company anniversary with a 30% discount on all its software products from May 1st through 5th, 2017. In spring 2002, DEVONtechnologies opened its website and... Read more
WaterField Designs Invites Customers to Help...
San Francisco based WaterField Designs invites customers and air travelers to participate in developing the next generation in-flight travel case, the Air Porter. Frustrated with limited legroom,... Read more

Jobs Board

*Apple* Mac Computer Technician - GeekHampto...
…complex computer issues over the phone and in person? GeekHampton, Long Island's Apple Premium Service Provider, is looking for you! Come work with our crew Read more
*Apple* Mobile Master - Best Buy (United Sta...
**501505BR** **Job Title:** Apple Mobile Master **Location Number:** 000849-Gurnee-Store **Job Description:** **What does a Best Buy Apple Mobile Master do?** At Read more
Best Buy *Apple* Computing Master - Best Bu...
**498428BR** **Job Title:** Best Buy Apple Computing Master **Location Number:** 000293-Rockville-Store **Job Description:** **What does a Best Buy Apple Read more
*Apple* Mac Computer Technician - GeekHampto...
…complex computer issues over the phone and in person? GeekHampton, Long Island's Apple Premium Service Provider, is looking for you! Come work with our crew Read more
*Apple* Retail - Multiple Positions- Chicago...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.