What process is running when a Mac's desktop is locked?

In our environment (10.5.8 and 10.6.8 only) we have a security procedure to start a screen saver after 20 minutes of desktop inactivity and require a password to unlock the desktop via MCX. Our energy saver preferences, baked into our disk images, set the display to sleep after 45 minutes and security preferences to require a password immediately on wake.

A lot of maintanance tasks and installs/upgrades that require restarts are run after hours via Casper policy so as to not interrupt the end users workflow. In order to preserve any unsaved work that a user might have open, I do not force a restart but have the OS prompt for logout which will be canceled by any unsaved documents or running processes - since a logged in user will cause Casper to just sit and wait for them to OK the restart, regardless of the existence of unsaved work. However a locked desktop will block the logout prompt and cause Casper to sit and wait for the user to OK a restart anyway, which is counterintuitive to my goals, so I need a failsafe way to detect a locked screen and unlock it first so the logout prompt isn't blocked.

Essentially the workflow I am trying to accomplish is this:

1. Casper runs a script to unlock a locked screen

2. Casper installs packages, runs scripts, etc

3. Casper logs the user out gracefully via the OS

I know to search for the ScreenSaverEngine process via applescript to find if the computer has the screen saver running and then to use system events to unlock the desktop, but once the display goes to sleep after 45 minutes, the screenSaverEngine process is no longer running so the detection script I'm using will fail even though the desktop is actually locked since it's only looking for a screen saver.

What process takes over that requires the screen to be unlocked once the display goes to sleep? This is the code I have so far.

#!/bin/sh

## Applescript to check for system idle time and simulate user input to unlock the Mac, and bash to determine if the Mac is simply at the login screen. Applescript will fail if no user is logged in, so use bash first to determine if anyone is logged into the console. If so, use the osascript below, if not, exit.

loggedInUser=`who | grep console`

if ["$loggedInUser" == "" ]; then

exit

else

## The following is a multi-line Applescript to verify system idle time and unlock the screen if necessary, called from the shell via osascript. It reads all text between the <<ENDDetectUnlock and ENDDetectUnlock entries into osascript and executes them as Applescript commands.

osascript<<ENDDetectUnlock

set unlockAfter to 1202 -- The desktop is set to lock after 20 minutes of inactivity, however if the mouse is moved or keyboard pressed immediately after the screen saver starts, the Mac will NOT prompt for a password, so set the locked desktop check to 20 minutes and 2 seconds (1202 seconds)

tell application "System Events" to set screenSaverActive to (exists process "ScreenSaverEngine") -- the user may have their screen saver start before the system is idle for 20 minutes which will also lock the computer, so we need to check for this as well, since the system may not be idle for ~20.033 minutes yet

set idleTime to do shell script "echo $((`ioreg -c IOHIDSystem | sed -e '/HIDIdleTime/ !{ d' -e 't' -e '}' -e 's/.* = //g' -e 'q'` / 1000000000))" -- get the system idle time in seconds

if ((idleTime as integer) ≥ unlockAfter) or screenSaverActive then

tell application "System Events" -- if the system is idle for ~20.033 minutes or more OR the screen saver is active, unlock the screen by simulating the user pressing the space bar and unlocking the screen with their password (except we do it as the admin)

keystroke space

delay 1

keystroke tab

delay 1

keystroke "admin"

delay 1

keystroke tab

delay 1

keystroke "password"

delay 1

keystroke return

end tell

end if

ENDDetectUnlock

fi

My fallback is an asumption that since we are running these procedures after hours, ANY idle time will result in a locked screen, BUT since I am inputting text, my fear is that if the computer is idle less than 20 minutes, a user is logged in and has work open (even if it's saved), the text will then be written to whatever document is open, then work will be unsaved, Casper will wait, etc etc. Not to mention the fact that an administrative password will be written on their screen for them to copy, save, whatever.

TIA for any suggestions offered!

Andrew