macOS Sonoma & Sequoia Aerial Screensaver Management Guide

1. Architectural Evolution: macOS Sonoma & Sequoia Screensaver Engine

Prior to macOS 14 Sonoma, managing corporate screensavers on Mac fleets was straightforward: administrators pushed a custom slide show folder or .saver bundle and manipulated com.apple.screensaver.plist. However, macOS Sonoma completely re-engineered the desktop, wallpaper, and lock screen subsystems.

Apple decoupled screensavers from the legacy WindowServer screensaver process, introducing ExtensionKit app extensions (such as /System/Library/ExtensionKit/Extensions/iLifeSlideshows.appex) and the idleassetsd daemon responsible for streaming 4K aerial drone and underwater slow-motion wallpapers stored in /Library/Application Support/com.apple.idleassetsd/. Because ExtensionKit extensions execute in heavily sandboxed containers, pushing custom branding requires configuring both ByHost preference domains (-currentHost) and designated photo chooser dictionaries.

2. Enterprise Preparation: Packaging Corporate Wallpaper & Screensaver Assets

Before executing the preference script, package your high-resolution corporate branding assets (PNG or JPEG, 3840x2160 recommended) and deploy them via Jamf Pro, Kandji, or Munki to a protected root directory:

zsh

# 1. Create target system directory
sudo mkdir -p "/Library/Screen Savers/CorporateBranding"

# 2. Deploy your company wallpaper images into the folder
sudo cp ~/Desktop/company_wallpaper_4k.jpg "/Library/Screen Savers/CorporateBranding/"

# 3. Ensure global read permissions across all console users
sudo chmod -R 755 "/Library/Screen Savers/CorporateBranding"
sudo chown -R root:wheel "/Library/Screen Savers/CorporateBranding"

3. Automated Deployment Script: Enforcing Custom Screensaver on Sonoma & Sequoia

This production shell script resolves the active console GUI user, writes the necessary ByHost preferences for ExtensionKit, points to the corporate image asset folder, and forces cfprefsd to reload:

bash

#!/bin/bash
# ==============================================================================
# Set Custom Corporate Screensaver for macOS Sonoma & Sequoia
# Script credit: Howie Isaacks & Shri Sivakumaran (MacTechBuds)
# ==============================================================================

# 1. Resolve active logged-in console user
current_user=$(/usr/sbin/scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }')
current_user_id=$(/usr/bin/id -u "$current_user" 2>/dev/null)

if [ -z "$current_user" ] || [ "$current_user" == "root" ]; then
    echo "[-] No active GUI console user logged in. Aborting."
    exit 0
fi

echo "[+] Target console user: $current_user (UID: $current_user_id)"

# Define asset path
ASSET_DIR="/Library/Screen Savers/CorporateBranding"

# 2. Write ByHost screensaver preferences
echo "[*] Configuring screensaver ByHost preferences..."
sudo -u "$current_user" /usr/bin/defaults -currentHost write com.apple.screensaver CleanExit -string "YES"
sudo -u "$current_user" /usr/bin/defaults -currentHost write com.apple.screensaver PrefsVersion -int 100
sudo -u "$current_user" /usr/bin/defaults -currentHost write com.apple.screensaver showClock -string "NO"

# 3. Set idle timeout (300 seconds = 5 minutes)
sudo -u "$current_user" /usr/bin/defaults -currentHost write com.apple.screensaver idleTime -int 300

# 4. Bind iLifeSlideshows ExtensionKit app extension
echo "[*] Registering ExtensionKit iLifeSlideshows module..."
sudo -u "$current_user" /usr/bin/defaults -currentHost write com.apple.screensaver moduleDict -dict \
    moduleName -string "iLifeSlideshows" \
    path -string "/System/Library/ExtensionKit/Extensions/iLifeSlideshows.appex" \
    type -int 0

# 5. Configure Photo Chooser properties
echo "[*] Setting asset directory and display style..."
sudo -u "$current_user" defaults -currentHost write com.apple.ScreenSaverPhotoChooser SelectedFolderPath -string "$ASSET_DIR"
sudo -u "$current_user" defaults -currentHost write com.apple.ScreenSaverPhotoChooser SelectedSource -int 3
sudo -u "$current_user" defaults -currentHost write com.apple.ScreenSaverPhotoChooser ShufflesPhotos -bool "true"
sudo -u "$current_user" defaults -currentHost write com.apple.ScreenSaver.iLifeSlideShows styleKey -string "Classic"

# 6. Flush cfprefsd to commit memory cache to disk
echo "[*] Flushing cfprefsd..."
/usr/bin/killall -HUP cfprefsd

echo "[✓] Corporate screensaver configured successfully."
exit 0

4. MDM Configuration Profile: Enforcing Lock Screen Security

While the script sets the screensaver artwork, enterprise security compliance (CIS macOS Benchmark / ISO 27001) mandates enforcing screensaver lock time and immediate password prompt via an MDM configuration profile:

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadType</key>
    <string>com.apple.screensaver</string>
    <!-- Enforce maximum idle time before screensaver starts (300 seconds = 5 minutes) -->
    <key>idleTime</key>
    <integer>300</integer>
    <!-- Require password immediately upon waking from screensaver -->
    <key>askForPassword</key>
    <integer>1</integer>
    <key>askForPasswordDelay</key>
    <integer>0</integer>
</dict>
</plist>

5. Troubleshooting Matrix for macOS Screensavers

Issue / Symptom	Underlying Root Cause	Remediation Step
Screensaver shows solid black screen instead of corporate images	Asset folder permissions prevent the sandboxed ExtensionKit extension from reading images	Run `sudo chmod -R 755 "/Library/Screen Savers/CorporateBranding"` to grant world read access.
Preferences revert back to default Sonoma aerials	Script was executed without `-currentHost` flag, writing to global domain instead of ByHost	Ensure all `defaults write` calls include `-currentHost` parameter.
End-user overrides corporate screensaver	No MDM restrictions payload deployed to lock System Settings	Deploy an MDM profile with `com.apple.systempreferences` restricting access to Wallpaper & Screen Saver settings pane.

6. Frequently Asked Questions (FAQ)

Q: Why did Apple switch screensavers to ExtensionKit in macOS Sonoma?

A: ExtensionKit enforces modern sandboxing and memory isolation, preventing malicious third-party screensaver binaries from exploiting the lock screen process or capturing keystrokes.

Q: Can I use animated video screensavers (like .mov or aerials) for corporate branding?

A: Yes, but custom videos require configuring the idleassetsd SQLite database (/Library/Application Support/com.apple.idleassetsd/Customer/), which is protected by SIP. The iLifeSlideshows photo approach remains the most stable, upgrade-safe method.

Set Screensaver in macOS Sonoma and Above