How to Enforce a Maximum Use Time on Mac OS X

Use time restrictions are often essential for Mac computers in shared environments such as schools, labs, and public buildings. A computer’s use time is the maximum amount of time a user can use the computer. After that period has elapsed, the user should log out to allow others an opportunity to use the computer.

Enforcing this time restriction is not trivial. You need a solution that is flexible enough to allow for different policies, that provides ample warning to the user, and avoids burdening staff with implementing the policy.

We were recently approached to see if Power Manager could help enforce a use time policy. The feature is not built-in but it seemed possible.

Download a copy of the Enforce Maximum Use Time Schedule for Power Manager.

We ended up creating two Power Manager events. One event to handle enforcing the log out and a second event to deal with users who logged out before the maximum time had passed.

Waiting and Logging Out

Let’s look at the first event. This event was created use the event editor and combines a single trigger with a couple of actions.

The event is triggered when a user logs in.

Once triggered the event performs two actions: wait for an hour, then perform an automatic log out.

This is all it takes to ensure no-one is logged in for more than one hour at a time. Power Manager automatically deals with warning the user about the pending log out and provides ample notifications.

Resetting the Timer

The first event deals with users who over stay their time at the Mac, or who leave the Mac logged in. In both cases once an hour has passed, Power Manager will step in and perform an automatic log out.

What the first event does not handle is users who log out before the hour has passed.

If a user logs outs before an hour has passed, the first event’s timer will not be reset. The timer exists beyond the scope of the user. We need a way to stop the timer when the user logs out.

We solve this limitation with a second event. This additional event performs a short script each time a user logs out. The short script cancels any pending events that match the first event.

The script effectively cleans up any use time enforcement event that is no longer needed.

#!/usr/bin/perl

use strict;
use warnings;

# Path to the Power Manager command line tool
my $pmctl = '/Library/Application Support/Power Manager/Tools/pmctl';

# Get a list of pending events as a perl structure
my $pending_events_raw = `'$pmctl' scheduler.pending`;
my $pending_events = eval($pending_events_raw);

# Loop through events looking for our event's continuation (...)
foreach my $event (@{$pending_events}) {

    # Match by event name + triple period
    if ($event->{'event'}{'name'} eq 'Cancel use limit...') {

        # Cancel matched event
        my $trigger_id = $event->{'trigger ID'};
        `'$pmctl' scheduler.cancel 'trigger ID=$trigger_id'`;
    }
}

The second event’s script is written in perl, but any other shell savvy language could be used. The perl script uses the included pmctl tool to query the pending events, then searches through the events. Any matched events are then passed back to pmctl to be cancelled.

Effective Enforcement

These two events offer an easy way to enforce maximum use time on the Mac.

Note that users with administrator rights can overrule the maximum use time for their own sessions or on behalf of others.

With the addition of conditions to the first event, it becomes possible to selectively enforce the policy depending on the day of the week or time of the day. Imagine having short use times only during busy hours; this is all possible with Power Manager.