{"id":1620,"date":"2025-02-11T01:27:28","date_gmt":"2025-02-11T06:27:28","guid":{"rendered":"https:\/\/www.brunerd.com\/blog\/?p=1620"},"modified":"2025-02-15T03:01:42","modified_gmt":"2025-02-15T08:01:42","slug":"zoom-rooms-that-dont-auto-login-after-macos-updates-solved","status":"publish","type":"post","link":"https:\/\/www.brunerd.com\/blog\/2025\/02\/11\/zoom-rooms-that-dont-auto-login-after-macos-updates-solved\/","title":{"rendered":"Zoom Rooms that don’t auto login after macOS updates: Solved"},"content":{"rendered":"\n

So here’s the situation: You have a Mac mini that’s used as a Zoom Room controller. You’ve enabled automatic login. You don’t<\/em> want the screensaver to come on ever and it should never ask for a password if the screen is turned off. This is a common ask and used to be really simple. You’d just go into Jamf, create a configuration profile, add the Applications & Custom Settings payload<\/strong>, choose Upload<\/strong>, set the domain to com.apple.screensaver<\/code> and add two XML keys askForPassword<\/code> and idleTime<\/code> set to integer<\/code> 0<\/code>. This is known as an “MCX” style payload, they are from the olden OS X Server days.<\/p>\n\n\n

\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

You made this payload years<\/strong> ago and it worked reliably for years<\/em>. Until Sonoma came out. Then you were hearing that Zoom Rooms were restarting after OS updates to the “lock screen” requiring a password?! What was going on? You open a Feedback and ACE case, you are asked for sysdiagnoses even though they are attached and you hear nothing. The summer passes, Sequoia comes out, “darn seems like they didn’t fix this”, you think. Then you wonder, maybe it’s not the OS that’s broken but something<\/em> else?<\/p>\n\n\n\n

Turns out Apple changed how macOS it interprets the Screensaver<\/a><\/code> domain keys in an MCX style payload. Apparently, it can’t tolerate them any more. Integer values of 0<\/code> now cause it to Immediately<\/strong> ask for password! Now, instead of setting askForPassword<\/strong><\/code> to the integer 0<\/code> it’s boolean<\/em> and you need to set that to true<\/strong><\/code> (yeah, that’s right, true<\/strong><\/em>) and then you set the key askForPasswordDelay<\/strong><\/code> to… yeah, you got it: 2147483647<\/strong><\/code>! That’s what you were gonna say right? \ud83d\ude11 See the Apple documentation<\/a> and check your incredulity at the door, they say this has been around since 10.11 and the crazy high askForPasswordDelay<\/strong><\/code> value they say came about in 10.13<\/strong><\/em><\/span> but macOS sure as heck respected the simple MCX style payloads up until macOS 13<\/span><\/strong>!? So is this a typo? Regardless it’s super unintuitive, unfriendly and non-obvious<\/p>\n\n\n

\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

Thankfully, they didn’t<\/em> mess with how idleTime<\/code> is interpreted, it still works as an integer<\/code> set to 0<\/code>. Here’s the whole thing in an MDM .mobileconfig file.<\/p>\n\n\n\n

<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-\/\/Apple\/\/DTD PLIST 1.0\/\/EN\" \"http:\/\/www.apple.com\/DTDs\/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n\t<key>PayloadContent<\/key>\n\t<array>\n\t\t<dict>\n\t\t\t<key>PayloadDisplayName<\/key>\n\t\t\t<string>Screensaver<\/string>\n\t\t\t<key>PayloadIdentifier<\/key>\n\t\t\t<string>com.apple.screensaver.9ABFE38F-2822-47FD-B2E3-5FBC49AFAD1B<\/string>\n\t\t\t<key>PayloadType<\/key>\n\t\t\t<string>com.apple.screensaver<\/string>\n\t\t\t<key>PayloadUUID<\/key>\n\t\t\t<string>9ABFE38F-2822-47FD-B2E3-5FBC49AFAD1B<\/string>\n\t\t\t<key>PayloadVersion<\/key>\n\t\t\t<integer>1<\/integer>\n\t\t\t<key>askForPassword<\/key>\n\t\t\t<true\/>\n\t\t\t<key>askForPasswordDelay<\/key>\n\t\t\t<integer>2147483647<\/integer>\n\t\t\t<key>idleTime<\/key>\n\t\t\t<integer>0<\/integer>\n\t\t\t<key>loginWindowIdleTime<\/key>\n\t\t\t<integer>0<\/integer>\n\t\t<\/dict>\n\t<\/array>\n\t<key>PayloadDescription<\/key>\n\t<string>Disallows screensaver and lock screen password<\/string>\n\t<key>PayloadDisplayName<\/key>\n\t<string>Passcode and Screensaver (Exempt, 14 up)<\/string>\n\t<key>PayloadIdentifier<\/key>\n\t<string>com.example.zoomroom.screensaver-passcode<\/string>\n\t<key>PayloadType<\/key>\n\t<string>Configuration<\/string>\n\t<key>PayloadUUID<\/key>\n\t<string>FBD0991C-8F71-4F69-98D9-4F03943C420A<\/string>\n\t<key>PayloadVersion<\/key>\n\t<integer>1<\/integer>\n<\/dict>\n<\/plist><\/code><\/pre>\n\n\n\n
As you can see things are a bit more complicated now. Applications & Custom Settings<\/strong> won’t make payloads like this and if you upload this to Jamf, make sure to sign it<\/strong> (with something like Hancock<\/a>) otherwise<\/em> it will throw out the stuff it doesn’t understand. Just look at what it does<\/em> understand out of all that.<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
And if you wonder, “Well doesn’t the Jamf GUI let you build a config profile with the settings you need” the answer is no, it doesn’t, the time is a drop down that goes from “Immediately” to “8 hours” just a hair shy of 2147483647<\/strong><\/code><\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
No, I haven’t made a “Jamf idea<\/a>” about this, although I did make an unfruitful FB (FB13736030) with Apple July 2024. I just don’t think they care much about MCX payloads acting weird. Why it needed to so radically change things isn’t clear but for now, if you want something that works, copy the above XML into a file that ends in .mobileconfig<\/code>, sign with Hancock<\/a> (or similar) and upload into your Jamf’s Configuration Profiles and scope only to Sonama and higher Macs. Make sure to exclude your old payload from them too. Now, next time your Zoom Room Mac gets an OS update, it will auto-login (if you’ve set that) after restart without getting stuck at the lock screen.<\/p>\n","protected":false},"excerpt":{"rendered":"
So here’s the situation: You have a Mac mini that’s used as a Zoom Room controller. You’ve enabled automatic login. You don’t want the screensaver to come on ever and it should never ask for a password if the screen is turned off. This is a common ask and used to be really simple. You’d […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,16,46,8],"tags":[25,63,65,62],"class_list":["post-1620","post","type-post","status-publish","format-standard","hentry","category-apple","category-bugs","category-jamf","category-security","tag-macos","tag-mdm","tag-screenlock","tag-zoom"],"_links":{"self":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts\/1620","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/comments?post=1620"}],"version-history":[{"count":11,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts\/1620\/revisions"}],"predecessor-version":[{"id":1642,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts\/1620\/revisions\/1642"}],"wp:attachment":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/media?parent=1620"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/categories?post=1620"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/tags?post=1620"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}