Audit Lockdown Mode

LowLevel 2Manual reviewmacos

Description

Apple introduced Lockdown Mode as a security feature in their 2022 OS releases that provides additional security protection Apple describes as extreme. Users and organizations that suspect some users are targets of advanced attacks must consider using this control. When lockdown mode is enabled, specific trusted websites can be excluded from Lockdown protection if necessary.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

GUI: System Settings > Privacy & Security > Verify Lockdown Mode is set to your organization's requirements. Terminal: sudo -u <username> /usr/bin/defaults read .GlobalPreferences.plist LDMGlobalEnabled 2>/dev/null When Lockdown mode has been enabled, it will return 1 and when disabled return 0. If

How it is fixed

Fix method: Guidance or infrastructure patch

GUI: System Settings > Privacy & Security > Set Lockdown Mode to your organization's requirements.

Properties

Operating systems: macos-26
Tags: macossystem-settings
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 2.6.7 Audit Lockdown Mode