Any plans on catching up with Kolide on this?

Hello @Toni Sanmateu! We don't keep up with the Kolide feature set when building out our roadmap (separate companies), but thank you for bringing this to the community. I've checked with the solutions consulting teams to see if there are ways we've addressed this because the ask sounds familiar to me, and someone else may chime in here soon! Additionally, feel free to file a feature request using the template here: https://github.com/fleetdm/fleet/issues/new?template=feature-request.md for any features you'd like to see in Fleet.

Thanks Zay! This is a great question Toni! Today in Fleet we do support the Screenlock table. https://fleetdm.com/tables/screenlock This may not address every part of what you're looking to do currently but should be a good place to start, especially if considering filing a feature request.

Thank you both. @Matt Rebelo I've tried setting the screenlock_is_enabled query in my configs to read from the screenlock table but unfortunately, it does not work due to the table requiring

run as user

privileges. I tried workarounds, from reading the

plist

table directly to trying a shell script trigger via the shell table, which seems to be disabled by default with Fleet. The

plist

stops working too when the path enters user domain. It worked on

Library/Managed Preferences

but did not on

Library/Preferences

for example.

Have you granted Fleet full disk access via MDM?

I've exhausted all the tips and tricks I could read around and gather from your team (assisted to Fridays open hours).

Do you have MDM? Even a non-Fleet MDM?

So techincally, this solution is for those clients that don't yet have an MDM

I suspect even if you had

run as user

, you would still be blocked without orbit having FDA via MDM.

Not 100% sure what you mean by FDA via MDM. I technically can access the screenlock table via osqueryi. That's what initially led me to beiieve it was possible

Full Disk Access

Hmmm interesting... How about building an osquery extension? I'm trying to figure out what could be the best solution. Kolide's article caught my attention, since they did solve this issue

That doc only points out that some system directories are restricted, but it also applies to user directories.

No worries at all hehe I really appreciate the discussion

It is really hard to manage macOS devices in 2025 (or 2022 for that matter) without MDM.

My problem is that I build the whole integration for osqueryd to communicate with my company's backend and they wanted to check 4 things including screenlock, and we're literally blocked by that last check. So I am trying all over the place to find a solution. Apparently Vanta does this, but every time I doubt it more.