Tutorial

Implement comprehensive screen lock security policies across your Roundfleet devices using AppleScript automation and advanced security configurations. This tutorial covers password enforcement, sleep security management, and enterprise-grade lock mechanisms.

Understanding macOS Screen Lock Security

macOS provides multiple layers of screen lock security:

• Screen Saver Password - Requires password when returning from screen saver
• Sleep Password - Requires password when waking from sleep mode
• Immediate Lock - Sets password requirement timing to immediate
• Security Preferences - System-level security configuration management

Basic Screen Lock Configuration

Enable Password for Screen Lock

#!/bin/bash

# Basic screen lock password enablement
enable_screen_lock_password() {
    echo "=== Enabling Screen Lock Password ==="
    
    # Enable password requirement for screen lock using AppleScript
    if osascript -e 'tell application "System Events" to set require password to wake of security preferences to true'; then
        echo "✅ Screen lock password enabled successfully"
        
        # Verify the setting
        local current_setting=$(osascript -e 'tell application "System Events" to get require password to wake of security preferences')
        if [[ "$current_setting" == "true" ]]; then
            echo "✅ Password requirement verified: enabled"
        else
            echo "⚠️  Password requirement verification failed"
        fi
    else
        echo "❌ Failed to enable screen lock password"
        return 1
    fi
}

enable_screen_lock_password

Check Current Screen Lock Status

#!/bin/bash

# Check current screen lock password status
check_screen_lock_status() {
    echo "=== Screen Lock Status Check ==="
    
    # Get current password requirement status
    local password_required=$(osascript -e 'tell application "System Events" to get require password to wake of security preferences' 2>/dev/null)
    
    if [[ "$password_required" == "true" ]]; then
        echo "✅ Screen lock password: ENABLED"
    elif [[ "$password_required" == "false" ]]; then
        echo "❌ Screen lock password: DISABLED"
    else
        echo "⚠️  Screen lock password status: UNKNOWN"
    fi
    
    # Get screen saver timeout settings
    local saver_timeout=$(defaults read com.apple.screensaver idleTime 2>/dev/null || echo "Unknown")
    echo "Screen saver timeout: $saver_timeout seconds"
    
    # Get display sleep timeout
    local display_sleep=$(pmset -g | grep displaysleep | awk '{print $2}')
    echo "Display sleep timeout: $display_sleep minutes"
    
    # Get system sleep timeout
    local system_sleep=$(pmset -g | grep sleep | grep -v displaysleep | awk '{print $2}')
    echo "System sleep timeout: $system_sleep minutes"
}

check_screen_lock_status

Advanced Security Configuration

Comprehensive Screen Lock Setup

#!/bin/bash

# Advanced screen lock security configuration
configure_advanced_screen_lock() {
    local timeout_minutes="${1:-5}"
    local grace_period="${2:-0}"
    
    echo "=== Advanced Screen Lock Configuration ==="
    echo "Timeout: $timeout_minutes minutes"
    echo "Grace period: $grace_period seconds"
    
    # Enable password requirement for screen lock
    echo "Enabling password requirement..."
    if osascript -e 'tell application "System Events" to set require password to wake of security preferences to true'; then
        echo "✅ Password requirement enabled"
    else
        echo "❌ Failed to enable password requirement"
        return 1
    fi
    
    # Set password delay (grace period)
    echo "Setting password delay..."
    if osascript -e "tell application \"System Events\" to set delay interval of security preferences to $grace_period"; then
        echo "✅ Password delay set to $grace_period seconds"
    else
        echo "⚠️  Password delay setting may have failed"
    fi
    
    # Configure screen saver timeout
    echo "Configuring screen saver timeout..."
    local timeout_seconds=$((timeout_minutes * 60))
    defaults write com.apple.screensaver idleTime -int $timeout_seconds
    
    # Enable screen saver password immediately
    defaults write com.apple.screensaver askForPassword -int 1
    defaults write com.apple.screensaver askForPasswordDelay -int $grace_period
    
    # Configure system sleep settings
    echo "Configuring power management..."
    sudo pmset -a displaysleep $timeout_minutes
    sudo pmset -a sleep $((timeout_minutes + 5))
    
    # Apply hot corners for immediate lock (optional)
    configure_hot_corners
    
    echo "✅ Advanced screen lock configuration completed"
}

# Configure hot corners for security
configure_hot_corners() {
    echo "Configuring security hot corners..."
    
    # Bottom right corner: Start screen saver
    defaults write com.apple.dock wvous-br-corner -int 5
    defaults write com.apple.dock wvous-br-modifier -int 0
    
    # Top right corner: Put display to sleep
    defaults write com.apple.dock wvous-tr-corner -int 10
    defaults write com.apple.dock wvous-tr-modifier -int 0
    
    # Restart Dock to apply changes
    killall Dock
    
    echo "✅ Hot corners configured for enhanced security"
}

# Usage: configure_advanced_screen_lock 3 0
configure_advanced_screen_lock

Security Policy Enforcement

#!/bin/bash

# Enforce enterprise security policies
enforce_security_policies() {
    echo "=== Security Policy Enforcement ==="
    
    # Disable automatic login
    echo "Disabling automatic login..."
    sudo defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser 2>/dev/null || true
    
    # Enable fast user switching menu
    echo "Configuring user switching..."
    sudo defaults write /Library/Preferences/.GlobalPreferences MultipleSessionEnabled -bool YES
    defaults write .GlobalPreferences userMenuExtraStyle -int 2
    
    # Disable guest account
    echo "Disabling guest account..."
    sudo defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool NO
    
    # Set login window to show name and password fields
    sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool YES
    
    # Hide admin users from login window
    sudo defaults write /Library/Preferences/com.apple.loginwindow Hide500Users -bool YES
    
    # Disable password hints
    sudo defaults write /Library/Preferences/com.apple.loginwindow RetriesUntilHint -int 0
    
    # Enable secure virtual memory
    sudo defaults write /Library/Preferences/com.apple.virtualMemory UseEncryptedSwap -bool YES
    
    echo "✅ Security policies enforced"
}

enforce_security_policies

Screen Saver and Lock Management

Screen Saver Configuration

#!/bin/bash

# Configure screen saver with security settings
configure_secure_screensaver() {
    local module_name="${1:-Flurry}"
    local timeout_minutes="${2:-5}"
    
    echo "=== Secure Screen Saver Configuration ==="
    echo "Module: $module_name"
    echo "Timeout: $timeout_minutes minutes"
    
    # Set screen saver module
    defaults -currentHost write com.apple.screensaver moduleDict -dict \
        moduleName "$module_name" \
        path "/System/Library/Screen Savers/$module_name.saver" \
        type 0
    
    # Set timeout
    local timeout_seconds=$((timeout_minutes * 60))
    defaults write com.apple.screensaver idleTime -int $timeout_seconds
    
    # Enable password immediately
    defaults write com.apple.screensaver askForPassword -int 1
    defaults write com.apple.screensaver askForPasswordDelay -int 0
    
    # Disable screen saver preview
    defaults write com.apple.screensaver showClock -bool NO
    
    # Set message on lock screen (optional)
    set_lock_screen_message
    
    echo "✅ Secure screen saver configured"
}

# Set custom lock screen message
set_lock_screen_message() {
    local message="${1:-This device is managed by Roundfleet. Unauthorized access is prohibited.}"
    
    echo "Setting lock screen message..."
    defaults write /Library/Preferences/com.apple.loginwindow LoginwindowText "$message"
    
    echo "✅ Lock screen message set"
}

# Usage: configure_secure_screensaver "Flurry" 3
configure_secure_screensaver

Manual Lock Mechanisms

#!/bin/bash

# Immediate lock mechanisms
immediate_lock_functions() {
    echo "=== Immediate Lock Mechanisms ==="
    
    # Method 1: Using pmset to sleep display
    lock_display_pmset() {
        echo "Locking display using pmset..."
        pmset displaysleepnow
    }
    
    # Method 2: Using osascript to activate screen saver
    lock_screensaver() {
        echo "Activating screen saver lock..."
        osascript -e 'tell application "System Events" to start current screen saver'
    }
    
    # Method 3: Using CGSession for fast user switching
    lock_fast_user_switch() {
        echo "Switching to login window..."
        /System/Library/CoreServices/Menu\ Extras/User.menu/Contents/Resources/CGSession -suspend
    }
    
    # Method 4: Using open command with screen saver
    lock_open_screensaver() {
        echo "Opening screen saver module..."
        open -a ScreenSaverEngine
    }
    
    # Default lock method
    lock_display_pmset
}

immediate_lock_functions

Enterprise Lock Management System

#!/bin/bash

# Roundfleet Enterprise Screen Lock Management System
# Comprehensive security policy enforcement and monitoring

# Configuration
SECURITY_CONFIG_FILE="/etc/roundfleet/screen_lock_config.conf"
LOG_FILE="/var/log/roundfleet_screen_lock.log"
STATUS_FILE="/var/log/roundfleet_security_status.json"

# Default security settings
DEFAULT_SCREEN_TIMEOUT=300    # 5 minutes
DEFAULT_GRACE_PERIOD=0        # Immediate
DEFAULT_DISPLAY_SLEEP=5       # 5 minutes
DEFAULT_SYSTEM_SLEEP=10       # 10 minutes

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Load security configuration
load_security_config() {
    if [[ -f "$SECURITY_CONFIG_FILE" ]]; then
        source "$SECURITY_CONFIG_FILE"
        log_action "Loaded security configuration from $SECURITY_CONFIG_FILE"
    else
        log_action "Using default security configuration"
    fi
}

# Apply enterprise screen lock policies
apply_enterprise_policies() {
    log_action "Applying enterprise screen lock policies"
    
    # Enable password requirement for screen lock
    log_action "Enabling screen lock password requirement"
    if osascript -e 'tell application "System Events" to set require password to wake of security preferences to true'; then
        log_action "✅ Screen lock password requirement enabled"
    else
        log_action "❌ Failed to enable screen lock password requirement"
        return 1
    fi
    
    # Set password delay
    local grace_period="${GRACE_PERIOD:-$DEFAULT_GRACE_PERIOD}"
    log_action "Setting password grace period to $grace_period seconds"
    osascript -e "tell application \"System Events\" to set delay interval of security preferences to $grace_period" 2>/dev/null
    
    # Configure screen saver settings
    local screen_timeout="${SCREEN_TIMEOUT:-$DEFAULT_SCREEN_TIMEOUT}"
    log_action "Setting screen saver timeout to $screen_timeout seconds"
    defaults write com.apple.screensaver idleTime -int $screen_timeout
    defaults write com.apple.screensaver askForPassword -int 1
    defaults write com.apple.screensaver askForPasswordDelay -int $grace_period
    
    # Configure power management
    local display_sleep="${DISPLAY_SLEEP:-$DEFAULT_DISPLAY_SLEEP}"
    local system_sleep="${SYSTEM_SLEEP:-$DEFAULT_SYSTEM_SLEEP}"
    
    log_action "Configuring power management: display=$display_sleep min, system=$system_sleep min"
    sudo pmset -a displaysleep $display_sleep
    sudo pmset -a sleep $system_sleep
    sudo pmset -a halfdim 1
    
    # Apply additional security settings
    apply_additional_security_settings
    
    log_action "screen lock policies applied successfully"
}

# Apply additional security settings
apply_additional_security_settings() {
    log_action "Applying additional security settings"
    
    # Disable automatic login
    sudo defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser 2>/dev/null || true
    
    # Disable guest account
    sudo defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool NO
    
    # Set login window to show name and password fields
    sudo defaults write /Library/Preferences/com.apple.loginwindow SHOWFULLNAME -bool YES
    
    # Hide admin users from login window
    sudo defaults write /Library/Preferences/com.apple.loginwindow Hide500Users -bool YES
    
    # Disable password hints
    sudo defaults write /Library/Preferences/com.apple.loginwindow RetriesUntilHint -int 0
    
    # Enable secure virtual memory
    sudo defaults write /Library/Preferences/com.apple.virtualMemory UseEncryptedSwap -bool YES
    
    # Set lock screen message if configured
    if [[ -n "${LOCK_SCREEN_MESSAGE}" ]]; then
        defaults write /Library/Preferences/com.apple.loginwindow LoginwindowText "$LOCK_SCREEN_MESSAGE"
        log_action "Set lock screen message"
    fi
    
    log_action "Additional security settings applied"
}

# Monitor screen lock compliance
monitor_screen_lock_compliance() {
    log_action "Monitoring screen lock compliance"
    
    local compliance_issues=0
    local timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)
    
    # Check password requirement
    local password_required=$(osascript -e 'tell application "System Events" to get require password to wake of security preferences' 2>/dev/null)
    local password_compliant=false
    
    if [[ "$password_required" == "true" ]]; then
        password_compliant=true
        log_action "✅ Password requirement: compliant"
    else
        ((compliance_issues++))
        log_action "❌ Password requirement: non-compliant"
    fi
    
    # Check screen saver timeout
    local current_timeout=$(defaults read com.apple.screensaver idleTime 2>/dev/null || echo "0")
    local timeout_compliant=false
    local max_allowed_timeout="${MAX_SCREEN_TIMEOUT:-600}"  # 10 minutes default
    
    if [[ "$current_timeout" -le "$max_allowed_timeout" && "$current_timeout" -gt 0 ]]; then
        timeout_compliant=true
        log_action "✅ Screen saver timeout: compliant ($current_timeout seconds)"
    else
        ((compliance_issues++))
        log_action "❌ Screen saver timeout: non-compliant ($current_timeout seconds)"
    fi
    
    # Check password delay
    local password_delay=$(defaults read com.apple.screensaver askForPasswordDelay 2>/dev/null || echo "300")
    local delay_compliant=false
    local max_allowed_delay="${MAX_PASSWORD_DELAY:-60}"  # 1 minute default
    
    if [[ "$password_delay" -le "$max_allowed_delay" ]]; then
        delay_compliant=true
        log_action "✅ Password delay: compliant ($password_delay seconds)"
    else
        ((compliance_issues++))
        log_action "❌ Password delay: non-compliant ($password_delay seconds)"
    fi
    
    # Check guest account status
    local guest_enabled=$(sudo defaults read /Library/Preferences/com.apple.loginwindow GuestEnabled 2>/dev/null || echo "true")
    local guest_compliant=false
    
    if [[ "$guest_enabled" == "0" || "$guest_enabled" == "false" ]]; then
        guest_compliant=true
        log_action "✅ Guest account: disabled (compliant)"
    else
        ((compliance_issues++))
        log_action "❌ Guest account: enabled (non-compliant)"
    fi
    
    # Generate compliance report
    local compliance_status='{
        "timestamp": "'$timestamp'",
        "device_id": "'$(system_profiler SPHardwareDataType | grep "Hardware UUID" | awk '{print $3}')'",
        "hostname": "'$(hostname)'",
        "compliance_score": '$((4 - compliance_issues))'/4,
        "total_issues": '$compliance_issues',
        "checks": {
            "password_required": '$password_compliant',
            "timeout_compliant": '$timeout_compliant',
            "delay_compliant": '$delay_compliant',
            "guest_disabled": '$guest_compliant'
        },
        "settings": {
            "current_timeout": '$current_timeout',
            "current_delay": '$password_delay',
            "guest_account": "'$guest_enabled'"
        }
    }'
    
    # Save compliance status
    echo "$compliance_status" | jq . > "$STATUS_FILE"
    
    if [[ $compliance_issues -eq 0 ]]; then
        log_action "✅ Screen lock compliance check passed (4/4)"
    else
        log_action "⚠️  Screen lock compliance issues found: $compliance_issues/4"
    fi
    
    return $compliance_issues
}

# Auto-remediate compliance issues
auto_remediate_compliance() {
    log_action "Starting auto-remediation for compliance issues"
    
    # Check current compliance
    monitor_screen_lock_compliance
    local issues=$?
    
    if [[ $issues -eq 0 ]]; then
        log_action "No compliance issues found, skipping remediation"
        return 0
    fi
    
    log_action "Found $issues compliance issues, attempting remediation"
    
    # Re-apply enterprise policies
    apply_enterprise_policies
    
    # Wait and re-check compliance
    sleep 5
    monitor_screen_lock_compliance
    local remaining_issues=$?
    
    if [[ $remaining_issues -lt $issues ]]; then
        log_action "✅ Remediation successful: reduced issues from $issues to $remaining_issues"
    else
        log_action "⚠️  Remediation incomplete: $remaining_issues issues remain"
    fi
    
    return $remaining_issues
}

# Generate security report
generate_security_report() {
    log_action "Generating comprehensive security report"
    
    local report_file="/var/log/roundfleet_security_report_$(date +%Y%m%d_%H%M%S).txt"
    
    {
        echo "Roundfleet Screen Lock Security Report"
        echo "Generated: $(date)"
        echo "Device: $(hostname)"
        echo "Hardware UUID: $(system_profiler SPHardwareDataType | grep "Hardware UUID" | awk '{print $3}')"
        echo "macOS Version: $(sw_vers -productVersion)"
        echo "====================================="
        echo ""
        
        echo "Screen Lock Configuration:"
        echo "Password Required: $(osascript -e 'tell application "System Events" to get require password to wake of security preferences' 2>/dev/null || echo 'Unknown')"
        echo "Screen Saver Timeout: $(defaults read com.apple.screensaver idleTime 2>/dev/null || echo 'Not set') seconds"
        echo "Password Delay: $(defaults read com.apple.screensaver askForPasswordDelay 2>/dev/null || echo 'Not set') seconds"
        echo ""
        
        echo "Power Management Settings:"
        pmset -g | grep -E "(sleep|displaysleep|halfdim)"
        echo ""
        
        echo "Login Window Security:"
        echo "Guest Account: $(sudo defaults read /Library/Preferences/com.apple.loginwindow GuestEnabled 2>/dev/null || echo 'Unknown')"
        echo "Show Full Name: $(sudo defaults read /Library/Preferences/com.apple.loginwindow SHOWFULLNAME 2>/dev/null || echo 'Unknown')"
        echo "Hide Admin Users: $(sudo defaults read /Library/Preferences/com.apple.loginwindow Hide500Users 2>/dev/null || echo 'Unknown')"
        echo ""
        
        echo "Security Compliance Status:"
        if [[ -f "$STATUS_FILE" ]]; then
            cat "$STATUS_FILE"
        else
            echo "No compliance data available"
        fi
        
    } > "$report_file"
    
    log_action "Security report saved to: $report_file"
}

# Emergency lock function
emergency_lock() {
    log_action "Emergency lock initiated"
    
    # Method 1: Immediate display sleep
    pmset displaysleepnow
    
    # Method 2: Activate screen saver
    osascript -e 'tell application "System Events" to start current screen saver' 2>/dev/null
    
    # Method 3: Switch to login window
    /System/Library/CoreServices/Menu\ Extras/User.menu/Contents/Resources/CGSession -suspend 2>/dev/null
    
    log_action "Emergency lock completed"
}

# Main screen lock management function
main() {
    local action="${1:-apply}"
    
    log_action "=== Roundfleet Screen Lock Management Started ==="
    
    case "$action" in
        "apply")
            load_security_config
            apply_enterprise_policies
            ;;
        "monitor")
            monitor_screen_lock_compliance
            ;;
        "remediate")
            auto_remediate_compliance
            ;;
        "report")
            generate_security_report
            ;;
        "lock")
            emergency_lock
            ;;
        "status")
            monitor_screen_lock_compliance
            ;;
        *)
            echo "Usage: $0 [apply|monitor|remediate|report|lock|status]"
            echo "  apply     - Apply enterprise screen lock policies (default)"
            echo "  monitor   - Monitor compliance status"
            echo "  remediate - Auto-remediate compliance issues"
            echo "  report    - Generate comprehensive security report"
            echo "  lock      - Emergency lock device immediately"
            echo "  status    - Check current compliance status"
            exit 1
            ;;
    esac
    
    log_action "=== Roundfleet Screen Lock Management Completed ==="
}

# Execute main function
main "$@"

Security Configuration File

Create a configuration file for enterprise security policies:

#!/bin/bash

# Create screen lock security configuration file
create_security_config() {
    local config_dir="/etc/roundfleet"
    local config_file="$config_dir/screen_lock_config.conf"
    
    # Create directory if it doesn't exist
    sudo mkdir -p "$config_dir"
    
    # Create configuration file
    sudo tee "$config_file" > /dev/null << 'EOF'
# Roundfleet Screen Lock Security Configuration
# All timeout values are in seconds unless specified

# Screen saver timeout (default: 300 seconds = 5 minutes)
SCREEN_TIMEOUT=300

# Password grace period after screen lock (default: 0 = immediate)
GRACE_PERIOD=0

# Display sleep timeout in minutes (default: 5 minutes)
DISPLAY_SLEEP=5

# System sleep timeout in minutes (default: 10 minutes)
SYSTEM_SLEEP=10

# Maximum allowed screen timeout for compliance (default: 600 seconds = 10 minutes)
MAX_SCREEN_TIMEOUT=600

# Maximum allowed password delay for compliance (default: 60 seconds)
MAX_PASSWORD_DELAY=60

# Lock screen message (optional)
LOCK_SCREEN_MESSAGE="This device is managed by Roundfleet. Unauthorized access is prohibited."

# Hot corners configuration (optional)
ENABLE_HOT_CORNERS=true
HOT_CORNER_BR=5    # Bottom right: Start screen saver
HOT_CORNER_TR=10   # Top right: Put display to sleep

# Security enforcement options
DISABLE_GUEST_ACCOUNT=true
DISABLE_AUTO_LOGIN=true
HIDE_ADMIN_USERS=true
DISABLE_PASSWORD_HINTS=true
ENABLE_SECURE_VM=true

# Monitoring settings
COMPLIANCE_CHECK_INTERVAL=3600  # 1 hour
AUTO_REMEDIATION=true
GENERATE_REPORTS=true
EOF

    echo "Screen lock security configuration created at: $config_file"
    echo "Please review and modify settings according to your security policies"
}

create_security_config

Integration with Roundfleet Management

#!/bin/bash

# Roundfleet screen lock security integration
roundfleet_security_integration() {
    echo "=== Roundfleet Screen Lock Security Integration ==="
    
    # Device information
    local device_id=$(system_profiler SPHardwareDataType | grep "Hardware UUID" | awk '{print $3}')
    local hostname=$(hostname)
    local macos_version=$(sw_vers -productVersion)
    
    # Get current security status
    local password_required=$(osascript -e 'tell application "System Events" to get require password to wake of security preferences' 2>/dev/null || echo "unknown")
    local screen_timeout=$(defaults read com.apple.screensaver idleTime 2>/dev/null || echo "0")
    local password_delay=$(defaults read com.apple.screensaver askForPasswordDelay 2>/dev/null || echo "unknown")
    
    # Security compliance assessment
    local compliance_score=0
    local total_checks=4
    
    [[ "$password_required" == "true" ]] && ((compliance_score++))
    [[ "$screen_timeout" -le 600 && "$screen_timeout" -gt 0 ]] && ((compliance_score++))
    [[ "$password_delay" -le 60 ]] && ((compliance_score++))
    
    local guest_disabled=$(sudo defaults read /Library/Preferences/com.apple.loginwindow GuestEnabled 2>/dev/null || echo "true")
    [[ "$guest_disabled" == "0" || "$guest_disabled" == "false" ]] && ((compliance_score++))
    
    # Report to Roundfleet API
    local api_data='{
        "device_id": "'$device_id'",
        "hostname": "'$hostname'",
        "timestamp": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
        "macos_version": "'$macos_version'",
        "screen_lock_security": {
            "password_required": "'$password_required'",
            "screen_timeout": '$screen_timeout',
            "password_delay": "'$password_delay'",
            "guest_account_disabled": "'$guest_disabled'",
            "compliance_score": '$compliance_score'/'$total_checks'
        },
        "security_management_status": "active"
    }'
    
    echo "Screen lock security status reported to Roundfleet management system"
    echo "Device ID: $device_id"
    echo "Compliance Score: $compliance_score/$total_checks"
    echo "Password Required: $password_required"
    echo "Screen Timeout: $screen_timeout seconds"
}

roundfleet_security_integration

macOS Version Compatibility

Version-Specific Considerations

#!/bin/bash

# Check macOS version compatibility
check_macos_compatibility() {
    local macos_version=$(sw_vers -productVersion)
    local major_version=$(echo "$macos_version" | cut -d. -f1)
    local minor_version=$(echo "$macos_version" | cut -d. -f2)
    
    echo "=== macOS Compatibility Check ==="
    echo "Current macOS version: $macos_version"
    
    # Check if version is supported (10.12 to 12.7)
    if [[ $major_version -eq 10 && $minor_version -ge 12 ]] || [[ $major_version -ge 11 && $major_version -le 12 ]]; then
        echo "✅ macOS version is supported"
        return 0
    elif [[ $major_version -ge 13 ]]; then
        echo "⚠️  macOS version may have limited support (testing recommended)"
        return 1
    else
        echo "❌ macOS version is not supported"
        return 2
    fi
}

check_macos_compatibility

Important Security Notes

Best Practices

• Test on pilot devices before fleet-wide deployment
• Regular compliance monitoring to ensure policy adherence
• Backup current settings before applying new policies
• Document policy changes for audit and troubleshooting purposes

Security Considerations

• Immediate password requirement provides strongest security
• Screen saver timeout should balance security with usability
• Guest account disabled prevents unauthorized access
• Lock screen messages provide contact information and legal notices

Troubleshooting

• System Preferences refresh may be required for changes to appear
• Administrator privileges needed for system-level security settings
• Restart may be required for some power management changes
• Test AppleScript commands individually if issues occur