Ensure Guest Account Is Disabled

ÉlevéeNiveau 1Automatiséemacos

Description

The guest account allows users access to the system without having to create an account or password. Guest users are unable to make setting changes and cannot remotely login to the system. All files, caches, and passwords created by the guest user are deleted upon logging out.

Méthode de vérification

Méthode d'audit: Commande shell

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('DisableGuestAccount'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('EnableGuestAccount'))
  let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow').objectForKey('GuestEnabled'))
  if ( ( pref1 == 1 && pref2 == 0 ) || ( pref3 == 0 ) ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

Sortie attendue: true

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Profile (preferred): com.apple.MCX DisableGuestAccount = <true/>; com.apple.MCX EnableGuestAccount = <false/>. Terminal: sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool false. GUI: System Settings > Users & Groups > i next to the Guest User > Set Allow guests to log in to this computer to disabled.

Propriétés

Systèmes d'exploitation: macos-15
Étiquettes: macossystem-settings
Référence: CIS Apple macOS 15.0 Sequoia Benchmark v2.1.0 - 2.13.1 Ensure Guest Account Is Disabled

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target macos