Ensure Wake for Network Access Is Disabled

FaibleNiveau 1Automatiséemacos

Description

This feature allows the computer to take action when the user is not present and the computer is in energy saving mode. These tools require FileVault to remain unlocked and fully rejoin known networks. This macOS feature is meant to allow the computer to resume activity as needed regardless of physical security controls.

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(/usr/bin/pmset -g custom 2>/dev/null) || exit 1
n=$(printf '%s\n' "$out" | /usr/bin/awk '$1 == "womp" && $2 != 0 {n++} END {print n+0}')
p=$(/usr/bin/profiles -P -o stdout 2>/dev/null | /usr/bin/grep -c '"Wake On LAN" = 1')
if [ "$n" -eq 0 ] && [ "${p:-0}" -eq 0 ]; then echo compliant; else echo "womp enabled ($n) / profile Wake On LAN=1 ($p)"; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Profile (preferred): com.apple.MCX com.apple.EnergySaver.desktop.ACPower = <dict>; com.apple.MCX com.apple.EnergySaver.portable.ACPower = <dict>; com.apple.MCX com.apple.EnergySaver.portable.BatteryPower = <dict>. Terminal: sudo /usr/bin/pmset -a womp 0. GUI: Desktop Instructions: System Settings > Energy Saver > Set Wake for network access to disabled. Laptop Instructions: System Settings > Battery > Options > Set Wake for network access to Never.

Propriétés

Systèmes d'exploitation: macos-26
Étiquettes: macossystem-settings
Référence: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 2.10.3 Ensure Wake for Network Access Is Disabled

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target macos