Spoke with my OS X guru, and he offers this (for 10.5):

you have to launch screencapture in the same security context as the loginwindow app in order to get the framebuffer contents

(me) so what exactly does context mean in this context?

PID=`ps -ax | grep loginwindow.app | grep -v grep | awk ‘{print $1}’`
sudo launchctl bsexec $PID screencapture /path/to/screencap.png

(me) so ARD is doing that behind the scenes?

launchctl’s bsexec command executes whatever you give to it in the same security context, or “Mach bootstrap namespace hierarchy” as the man page puts it

we decided that a logout hook script that loops until the loginwindow is up, then grabs the loginwindow PID and uses it with the launchctl bsexec to run screencapture might be best. Will let you know if I can get that working.

by al on May 16, 2008. #

Al, that is way cool, thanks so much for keeping on this and thanks to your OS X guru for the helping out here.

This is not unlike one of those thorny programming conundrums, you know there’s a way to do it, and you can’t stop until you figure it out.

I look forward to seeing what you come up with!


by john on May 16, 2008. #

Latest update- tried with a logout hook, but couldn’t get it to actually get to the loginwindow before it took the screencap.

So now I’m trying to use Lingon to set up Users Daemon running this shell script:

#! /binbash
sleep 90 # give the loginwindow 90 seconds to start
logger -t screencap_script “done sleeping” #logging
PID=`ps -ax | grep loginwindow.app | grep -v grep | awk ‘{print $1}’`
logger -t screencap_script “got the PID “$PID
launchctl bsexec $PID screencapture /Users/ladmin/Desktop/screencap.png
logger -t screencap_script “screencapture should now be done.”hs-rm190-002540:Sh

Aaaaannnnnddddd- it worked!

It’s a little annoying that I’m having to restart to fire it off, but at least it is working.

In Lingon 2.1 (this is only tested for Leopard) you click the new button, choose User Daemon, make up a name for it (part 1), point it at the script from above (part 2), check “Run it when it is loaded by the system (at startup or login)”, click the save button (authenticate with an admin account) and restart.

by al on May 19, 2008. #

last second thoughts about my last post:

you can shorten the sleep time, just make sure it’s long enough for the loginwindow to come up.

the logger lines can be removed or commented out, they were just for testing to see how far things were getting when it wasn’t working.

in Lingon, you could set a specific time for the screenshot, then log out and wait instead of restarting… not a lot better, and maybe worse since if you take too long to log out it’ll mess up, and if you set the time too far ahead you have to wait almost as long as if you had restarted (You wouldn’t check the Run it when… box, instead check the At a specific date and set accordingly.)

Finally, you could have it run every minute, and change the file name (screencapture /path/to/`date “+H;M”`.png where the back ticks ` around the date command tells the shell to run that and substitute the result, you would end up with a timestamped screenshot every minute until you disabled it in Lingon… still pretty messy, the restart doesn’t seem all that bad. ;-)

by al on May 19, 2008. #

Al, so what are all the steps needed to run this? I’m not familiar with Lingon, does this need to be downloaded/installed? Any other non-default apps needed?

Thanks, I’m looking forward to trying it!

by john on May 19, 2008. #

What about using SSH to log in to a computer that’s on the login screen and then using /usr/sbin/screencapture -o /tmp/ss.jpg or something? Haven’t tried this, so I can’t stand behind it, it’s just the first thing I think of.

by Ben on Jun 4, 2008. #

I’m not getting any results when running the script. I am definitely sure I set up Lingon correctly. When I try to run the script manually, here’s what I get:

task_for_pid() (os/kern) failure
Couldn’t switch to new bootstrap port: (ipc/send) invalid port right

by octel on Feb 17, 2009. #


have you ever try to take a picture with the mac camera of the user just after he logs? It is an idea I’m trying to implement to control access to our iMac labs. It should be taken in the less time and as a hidden process.


– juan falgueras

by Juan on Mar 5, 2009. #