Ensure Guest Account Is Disabled

HochStufe 1Automatisiertmacos

Beschreibung

The guest account allows users access to the system without having to create an account or password. Guest users are unable to make setting changes and cannot remotely login to the system. All files, caches, and passwords created by the guest user are deleted upon logging out.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('DisableGuestAccount'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('EnableGuestAccount'))
  let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow').objectForKey('GuestEnabled'))
  if ( ( pref1 == 1 && pref2 == 0 ) || ( pref3 == 0 ) ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

Erwartete Ausgabe: true

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Profile (preferred): com.apple.MCX DisableGuestAccount = <true/>; com.apple.MCX EnableGuestAccount = <false/>. Terminal: sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool false. GUI: System Settings > Users & Groups > i next to the Guest User > Set Allow guests to log in to this computer to disabled.

Eigenschaften

Betriebssysteme: macos-15
Tags: macossystem-settings
Referenz: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 2.13.1 Ensure Guest Account Is Disabled

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target macos