We ended up blogging about the screensaver checks that @allister and @zwass asked about in scrollback. https://blog.kolide.com/screensaver-security-on-macos-10-13-is-broken-a385726e2ae2 TL;DR osquery can't read them anymore because they're stored in the keychain. You can enforce the value with a profile but the payload has changed slightly.