Ensure Wake for Network Access Is Disabled

LowLevel 1Automatedmacos

Description

This feature allows the computer to take action when the user is not present and the computer is in energy saving mode. These tools require FileVault to remain unlocked and fully rejoin known networks. This macOS feature is meant to allow the computer to resume activity as needed regardless of physical security controls. This feature allows other users to be able to access your computer’s shared resources, such as shared printers or Apple Music playlists, even when your computer is in sleep mode. In a closed network when only authorized devices could wake a computer, it could be valuable to wake computers in order to do management push activity. Where mobile workstations and agents exist, the device will more likely check in to receive updates when already awake. Mobile devices should not be listening for signals on any unmanaged network or where untrusted devices exist that could sen...

How it is checked

Audit method: Shell command

shell

out=$(/usr/bin/pmset -g custom 2>/dev/null) || exit 1
n=$(printf '%s\n' "$out" | /usr/bin/awk '$1 == "womp" && $2 != 0 {n++} END {print n+0}')
p=$(/usr/bin/profiles -P -o stdout 2>/dev/null | /usr/bin/grep -c '"Wake On LAN" = 1')
if [ "$n" -eq 0 ] && [ "${p:-0}" -eq 0 ]; then echo compliant; else echo "womp enabled ($n) / profile Wake On LAN=1 ($p)"; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Graphical Method: Perform the following steps to disable Wake for network access: Desktop Instructions: 1. Open System Settings 2. Select Energy Saver 3. Set Wake for network access to disabled Laptop Instructions: 1. Open System Settings 2. Select Battery 3. Select Options... 4. Set Wake for network access to Never Terminal Method: Run the following command to disable Wake for network access: % /usr/bin/sudo /usr/bin/pmset -a womp 0 Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.MCX 2. The key to include is com.apple.EnergySaver.desktop.ACPower 3. The key must be set to: <dict> <key>Wake On LAN</key> <integer>0</integer> <key>Wake On Modem Ring</key> <integer>0</integer> </dict> 4. The key to also include is com.apple.EnergySaver.portable.ACPower 5. The key must be set to: <dict> <key>Wake On LAN</key> <integer>0</integer> <key>Wake On Modem Ring</key> <integer>0</integer> </dict> 6. The key to also include is com.apple.EnergySaver.portable.BatteryPower 7. The key must be set to: <dict> <key>Wake On LAN</key> <integer>0</integer> <key>Wake On Modem Ring</key> <integer>0</integer> </dict> Note: Both W...

Properties

Operating systems: macos-14
Tags: access-controlmacosnetworksonoma
Reference: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 2.9.3 Ensure Wake for Network Access Is Disabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos