Security and Privacy Profile is triggering auto logout.

Question

Level 1

0 points

Security and Privacy Profile is triggering auto logout.

I am running Server 3 on 10.9. I am administering a bunch of 10.8 Macs. I recently pushed some profile settings, including a Security and Privacy setting. Now all of the Macs are logging themselves out after 30 minutes. There is no control for this setting in the Security and Privacy options in Profile Manager. And these Macs were never configured to auto logout before I pushed this profile out.

Is there a way to turn this off programmatically through the command line? I can't seem to find any references to where this particular preference lives on the system.

Thanks,

Ken

MacBook Pro (15-inch Mid 2010), OS X Mavericks (10.9.4)

Posted on Aug 20, 2014 1:13 PM

Reply

Answer 1

Aug 20, 2014 3:39 PM in response to Big Bucket

You can see if the UI is showing the setting by going to:

System Preferences > Security & Privacy. Press the Advanced button in the bottom right.

Is the option enabled there? Can you turn it off?

Reid

Apple Consultants Network

Apple Professional Services

Author "Mavericks Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

Reply

Answer 2

Aug 20, 2014 3:46 PM in response to Strontium90

Oh, I forgot to include the location of where this is stored. It is in /Library/Preferences/.GlobalPreferences.plist. This is a hidden file. Use:

defaults read /Library/Preferences/.GlobalPreferences.plist

To read the file. The keys you are looking for are:

"com.apple.autologout.AutoLogOutDelay" = 0;

"com.apple.securitypref.logoutvalue" = 2820;

Looks like the second value is the value in the text field. Is the first value is 0, then the feature is off. If the value is non-0 then the service is active and will match the value of the second.

Reid

Apple Consultants Network

Apple Professional Services

Author "Mavericks Server – Foundation Services" :: Exclusively available in A

Reply

Answer 3

Big Bucket Author

Level 1

0 points

Aug 21, 2014 10:13 AM in response to Strontium90

Thanks!

I knew where the setting was in Security and Privacy, but it was never turned on before I pushed out the profile. The Profile Manager doesn't have any options for this setting under Security and Privacy, so it seems that it is being set by Profile Manager by default. I'll be able to use the plist location to modify the setting on all of our Macs without having to touch them all.

Thanks again,

Ken

Reply

Answer 4

Big Bucket Author

Level 1

0 points

Aug 21, 2014 12:27 PM in response to Big Bucket

I've now been banging on this for most of my day. While I can change the setting via Terminal, the change never sticks.

I have tried the following

sudo defaults write /Library/Managed\ Preferences/.GlobalPreferences.plist com.apple.autologout.AutoLogOutDelay 0

sudo defaults write /Library/Managed\ Preferences/[user shortname]/.GlobalPreferences.plist com.apple.autologout.AutoLogOutDelay 0

sudo defaults write /Library/Preferences/.GlobalPreferences.plist com.apple.autologout.AutoLogOutDelay 0

After changing all three of those, when I check Security and Privacy>General>Advanced, the Auto Logout is still enabled. Further, manually unchecking that setting in the GUI does not stick either.

I've also tried logging out and restarting after making those changes as well, with the same result. AutoLogOutDelay is still turned on in the GUI and it is still logging out my local admin user on a test machine.

I've also confirmed that there is no Security and Privacy profile payload in the Profiles preference pane.

Anyone know what is going on here?

Thanks,

Ken

Reply

Answer 5

Aug 22, 2014 4:23 AM in response to Big Bucket

By any chance do you have an MCX server still handing out management?

I can confirm that running this command:

sudo defaults write /Library/Preferences/.GlobalPreferences.plist com.apple.autologout.AutoLogOutDelay 0

Will it deactivate the UI?

However, if you are finding this in your Managed Preferences folder than that would suggest that MCX is handing this out.

So two thoughts. (1): Did you modify the local MCX template at some point in time? This is possible for AD environments in which there is no OS X Server but you want to alter the behavior of the management without a centralized management server. I've don't this to prevent mass storage devices. (2): Was there an OS X Server that was using MCX at some point in the past? The issue will be that MCX will keep enforcing these rules.

Now, you can try deleting the Managed Preferences folder and restart. You might even want to try this. Disconnect from your network. Delete the Managed Preferences folder and then reboot. Without the network, the device should not be able to reach the MCX server. Check the UI.

Reid

Apple Consultants Network

Apple Professional Services

Author "Mavericks Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

Reply

Answer 6

Big Bucket Author

Level 1

0 points

Aug 25, 2014 8:17 AM in response to Strontium90

I am not managing these Macs with Workgroup Manager, strictly Profile Manager. Only recently was I able to get all the Macs up to the same OS level (10.8.5). The server and my admin Mac are both running 10.9. (I've got a software dependency that is preventing me from bringing the workstations up to 10.9.)

I've never modified the local MCX template.

My OSX server has never used MCX in the past.

I will try removing the Managed Preferences folder.

Thanks,

Ken

Reply

Answer 7

Big Bucket Author

Level 1

0 points

Aug 25, 2014 10:19 AM in response to Big Bucket

I found the setting that has been eluding me.

In Profile Manager, General>Login Window>Options. Logout users after x minutes was checked.

Very frustrating that this preference is in a completely different location than where it is controlled in the GUI System Preferences.

Thank you for your help Reid, I do appreciate you pointing me to the .GeneralPreferences.plist files. If nothing else, it allowed me to exercise my terminal skills.

Thanks again,

Ken

Reply