Ensure Password Age Is Configured

HighLevel 1Automatedmacos

Description

Over time, passwords can be captured by third parties through mistakes, phishing attacks, third-party breaches, or merely brute-force attacks. To reduce the risk of exposure and to decrease the incentives of password reuse (passwords that are not forced to be changed periodically generally are not ever changed), users should reset passwords periodically. This control uses 365 days as the acceptable value. Audit: policyAttributeExpiresEveryNDays or policyAttributeDaysUntilExpiration must be <= 365.

How it is checked

Audit method: Shell command

shell

out=$(/usr/bin/pwpolicy -getaccountpolicies 2>/dev/null) || exit 1
val() { printf '%s\n' "$out" | /usr/bin/grep -A1 "$1" | /usr/bin/tail -1 | /usr/bin/cut -d'>' -f2 | /usr/bin/cut -d'<' -f1; }
p1=$(val policyAttributeExpiresEveryNDays)
p2=$(val policyAttributeDaysUntilExpiration)
ok=false
case "$p1" in ''|*[!0-9]*) ;; *) [ "$p1" -le 365 ] && ok=true;; esac
case "$p2" in ''|*[!0-9]*) ;; *) [ "$p2" -le 365 ] && ok=true;; esac
echo "$ok"

Expected output: true

How it is fixed

Fix method: Guidance or infrastructure patch

Profile (preferred): com.apple.mobiledevice.passwordpolicy maxPINAgeInDays = <integer><value≥365></integer>. Terminal: sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxMinutesUntilChangePassword=<value≤525600>" ; sudo /usr/bin/pwpolicy -n /Local/Default -setglobalpolicy "maxMinutesUntilChangePassword=43200".

Properties

Operating systems: macos-26
Tags: macossystem-access
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 5.2.7 Ensure Password Age Is Configured

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos