macOS restarting/logging out when screen locked


I’ve noticed for a while now, and I mean a long time (as in this affects both macOS Catalina and Mohave ), that if I locked my screen and went away for any length of time that I would come back to it midway through a restart. Normally iTerm2 had prevented shutdown, but half my applications would be closed. Today I figured I would work out why.

TLDR If you’re looking for a solution you can jump to the fix.

My first assumption – this is related to power settings, involved with Sleep/Hibernation. My working theory that the machine tries to sleep while locked and this upsets it, so my first thought was to confirm those settings.

pmset -g

This lists the system-wide power settings if ran in a terminal as an administrator (it doesn’t need root privileges). I was sort-of expecting autopoweroff to be set to 1 but nope, in this case that doesn’t seem to be the case. So it seems my settings are correct and nothing obvious looks like it will cause a power-off or restart while locked.

Maybe the issue, therefore, is an issue with the machine. While restarting, it’s not shown the typical Kernel panic style messages, and the reboot has been quick, but after some googling found George Garside blog which has a handy one-liner for looking at your logs for what the last shutdown cause was and more importantly what the error code are.

log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 24h

A few interesting things to note from the image, number 1 the timestamps are off by a couple of hours. The second that the shutdown cause was 5… Which is, it was correctly shutdown.

We shall skip over states 1, 2 & 4 and simply take the good news the machine is not crashing, it’s doing this on purpose. So something is sending /sbin/shutdown command. Yet the timestamp is bothering me; what if it’s not trying to shut down at all?

  • Sleep
  • Lock Screen
  • Log Out
  • Shutdown/Restart

Both Sleep and Lock screen leave the user’s apps and space intact while Log Out and shutdown close apps. I had made the assumption the machine was trying to shutdown and restart; what if it was just logging out?

Working out how to identify in the logs when a Log Out occurred was a little bit of trial and error, but eventually settled on searching for sessionlogoutd within messages.

log show --predicate 'eventMessage contains "sessionlogoutd"' --last 6h

Now that is the right timestamp, so the machine isn’t doing a full reboot, rather it’s logging my user out.

This also now totally smells like macOS itself not an application doing this, it seems far less likely an application would attempt to log out the user than restart it, so it’s looking more like there is something in macOS forcing a log out.

How to fix macOS automatically logging out

Once you know the problem, googling the answer is easy and it quickly becomes clear that you are not the first to have this issue.

But to summarise, macOS added a setting which logs you out even when the screen is locked as it is still counting this as inactivity. Applications like iTerm often prevent this and it tends to look like the machine is constantly restarting.

To fix you need to have administrator access then:

System Preferences -> Security and Privacy (unlock via padlock) -> Advanced

Then untick the Log Out after, checkbox, followed by OK.

It would appear this feature appeared in High Sierra, so now I have to wonder how long have I been putting up with it?

Anyway, mystery solved, and I learnt a few bits about macOS system logs along the way.

Helping you and your customers stay safe

WordPress Security Consulting Services

Power Hour Consulting

Want to get expert advice on your site's security? Whether you're dealing with a hacked site or looking to future-proof your security, Tim will provide personalised guidance and answer any questions you may have. A power hour call is an ideal starting place for a project or a way to break deadlocks in complex problems.

Learn more

Site Reviews

Want to feel confident about your site's security and performance? A website review from Tim has got you covered. Using a powerful combination of automated and manual testing to analyse your site for any potential vulnerabilities or performance issues. With a comprehensive report and, importantly, recommendations for each action required.

Learn more

Code Reviews

Is your plugin or theme code secure and performing at its best? Tim provides a comprehensive code review, that combine the power of manual and automated testing, as well as a line-by-line analysis of your code base. With actionable insights, to help you optimise your code's security and performance.

Learn more

Or let's chat about your security?

Book a FREE 20 minute call with me to see how you can improve your WordPress Security.

(No Strings Attached, honest!)