id: os_screensaver_timeout_loginwindow_enforce
title: Enforce Screen Saver Timeout at LoginWindow
discussion: |
  The screen saver timeout at LoginWindow _MUST_ be set to $ODV seconds or a shorter length of time.

  This rule ensures that a full session lock is triggered within no more than $ODV seconds of inactivity.
check: |
  /usr/bin/osascript -l JavaScript << EOS
  function run() {
    let timeout = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.screensaver')\
  .objectForKey('loginWindowIdleTime'))
    if ( timeout <= $ODV ) {
      return("true")
    } else {
      return("false")
    }
  }
  EOS
result:
  string: 'true'
fix: |
  This is implemented by a Configuration Profile.
references:
  cce:
    - CCE-95291-1
  cci:
    - CCI-000057
  800-53r5:
    - N/A
  srg:
    - N/A
  disa_stig:
    - N/A
  800-171r3:
    - N/A
  cis:
    benchmark:
      - N/A
    controls v8:
      - 4.3
macOS:
  - '26.0'
odv:
  hint: Number of seconds.
  recommended: 1200
tags:
  - none
severity: medium
mobileconfig: true
mobileconfig_info:
  com.apple.screensaver:
    loginWindowIdleTime: $ODV
