Disable Power Nap

What the Power Nap disabler does

This Automox Worklet™ disables the Power Nap feature on macOS endpoints. Power Nap is the macOS power management behavior that allows a sleeping Mac to periodically wake without lighting the display, then perform background work such as iCloud and mail synchronization, calendar and contact refreshes, Find My location reporting, Software Update checks, and Time Machine backups. The feature is on by default on most Apple silicon and Intel Macs that ship with a built-in battery.

The Worklet drives the built-in pmset utility to inspect and change the setting. The evaluation script runs pmset -g everything and counts how many power profiles report 'powernap 1', covering Battery Power, AC Power, and UPS profiles where present. When any profile still has Power Nap enabled, the remediation script runs pmset -a powernap 0, which writes the change across every profile in a single call. Endpoints that already report powernap 0 exit 0 without invoking pmset again on the remediation pass, which keeps repeat-run cost negligible.

Because the evaluation reads the live pmset state on every run, the Worklet catches drift introduced by macOS upgrades, MDM profile rollbacks, and user changes made through System Settings > Battery > Options.

Why enforce a Power Nap baseline

Power Nap changes the security and operational profile of every sleeping Mac in the fleet. A laptop with Power Nap enabled wakes silently on battery and more often on AC, opens network connections to Apple and any third-party push providers, and consumes battery the user did not authorize. In restricted environments, those silent wake cycles undermine the assumption that a sleeping endpoint is an inactive endpoint and can mask the network signal of an actual compromise. The CIS Benchmark for macOS calls out Power Nap explicitly and expects the feature to be disabled on managed endpoints.

Power Nap drifts back on in three predictable ways: a user toggles the Battery preference pane, an MDM profile applies and then fails to reassert, or a macOS point release resets the default. Any one of those events flips Power Nap back on and the laptop walks out of the baseline silently. This Worklet runs pmset -a powernap 0 on every Mac in scope, which writes the new value to the pmset configuration that persists across reboot. Repeat runs on already-disabled endpoints finish in milliseconds, and divergent Macs surface in the Automox activity log with the evaluation message 'Power Nap is enabled. Moving to remediation...'.

How Power Nap enforcement works

1. Evaluation phase: The Worklet runs pmset -g everything and pipes the output to grep -c 'powernap 1' to count how many profiles still have Power Nap enabled. A result of 0 means every profile already reports powernap 0 and the endpoint exits clean. Any non-zero count flags the endpoint as non-compliant and triggers remediation, so a Mac with Power Nap disabled on battery but still enabled on AC is correctly caught.

2. Remediation phase: The remediation script re-runs the same powernap count check first. If any profile still reports powernap 1, it executes pmset -a powernap 0. The -a flag tells pmset to apply the change to all power source profiles in one call, so Battery, Charger, and UPS settings move to powernap 0 together. No reboot is required; the change takes effect on the next sleep cycle, and the next scheduled evaluation confirms compliance.

Power Nap policy requirements

• macOS endpoint with Power Nap capability (built-in batteries on MacBook Air, MacBook Pro, and most iMac models with Apple silicon or recent Intel chipsets)

• Root privileges on the endpoint; the Automox agent runs with the required context by default

• pmset present at /usr/bin/pmset, which ships with every supported version of macOS

• No conflicting MDM configuration profile that resets Power Nap to enabled; if one exists, remove it or align it with this Worklet to avoid an enforcement loop

• Bash 3.2 or newer (default on every supported macOS release)

Expected state after Power Nap remediation

After the Worklet runs, pmset -g everything reports powernap 0 on every available power profile. The Mac no longer wakes silently on battery or AC for iCloud sync, mail fetch, Time Machine snapshots, or Software Update polling. The visible side effects are usually positive: longer battery life on idle laptops, fewer wake-from-sleep events, and a quieter network footprint during overnight hours.

Validate the change with pmset -g | grep powernap, which prints the active value for the current power source, or pmset -g custom, which lists every profile and its powernap value. For audit evidence aligned to the CIS Benchmark for macOS, capture the full pmset -g everything output and store it with the Automox policy run identifier. Subsequent Worklet runs report the message 'Power Nap is already disabled. Exiting...' and skip remediation, so the policy can stay on a daily or weekly cadence without generating noise in Automox activity logs. If a future macOS upgrade or MDM profile re-enables Power Nap, the next evaluation counts a non-zero powernap value across the affected profile and remediation reapplies pmset -a powernap 0 within the same policy run.