Enable Power Nap Failing on Newer Macs

[johnsonea2NIH]

Hello all! We are currently using the mSCP to configure our security baseline for our Jamf pro instance. We are consistently failing the check for os_power_nap_enable. We have Silicon M1 macs running macOS 13 that were released in 2021. We don’t have the physical toggle button, as well as the cmd to fix returns a 2 instead of 1 preventing us from passing.

What can we do to satisfy this control?

[vaughnhart]

I believe you can modify the pmset command to enable womp 1 and powernap 1.

sudo pmset -a enable womp 1
Sudo pmset -a enable powernap 1

man pmset should give you guidance or the apple developer page for pmset (I think).

But these setting above mean your machine is always on and waking for network access. To disable it should be 0 as in the Sonoma Guidance.

[robertgendler]

This rule should be marked i386 as it ONLY works on Intel Macs. Apple Silicon Macs always have power nap enabled and there's no toggling on or off.

Now I have no idea why you're failing it. You'd have to post some more information. But you can probably remove that setting as I don't believe it's on any benchmark or baseline.

[vaughnhart]

I am running on Apple Silicon and Power Nap is disabled. I'll add the scripted portion of my pmset (also in another thread so you can try it yourself). My machine goes to sleep pretty fast though. No input.. zzzzz.

[robertgendler]

You may be disabling it, but it doesn't actually disable.

I forget the log predicate but we did some watching of unified logging and nothing happens on Apple Silicon but there's things that happen when ran on intel.

[vaughnhart]

That's odd... my machine goes to hibernate in less than a minute.

Password:
System-wide power settings:
DestroyFVKeyOnStandby 1
Currently in use:
standby 0
Sleep On Power Button 1
SleepServices 0
hibernatefile /var/vm/sleepimage
powernap 0
networkoversleep 0
disksleep 10
sleep 1 (sleep prevented by installd, powerd)
hibernatemode 25
ttyskeepawake 1
displaysleep 2
tcpkeepalive 1
lowpowermode 0
womp 0

set by a script:
sudo pmset -a destroyfvkeyonstandby 1
sudo pmset -a hibernatemode 25
sudo pmset -a powernap 0
sudo pmset -a standby 0
sudo pmset -a standbydelay 0
sudo pmset -a autopoweroff 0
sudo pmset -a womp 0
sudo pmset -a sleep 1
sudo pmset -a displaysleep 2
sudo pmset -a networkoversleep 0

Though I may have manually set wake to Never... but I don't think so.

[robertgendler]

When power nap is enabled on Intel, when the computer is asleep it can still do some tasks like receive email

https://support.apple.com/guide/mac-help/what-is-power-nap-mh40773/mac

Part of the reason there was originally a disable rule was because it did something funky to the USB bus and smartcard readers had problems waking from sleep. That's kind of fixed.

[vaughnhart]

I didn't know that... but I'm not on a M2 or M3. I think. you have to combine the rules in order to get proper sleep/hibernate. It's not one rule to rule them all... as some sleep/power nap/display/screensaver settings override others. Think of it as having an xor gate or is that an xand gate... you gotta hit all the right variables, then it works on Apple Silicon.