TMA-MACOS-2.13.1

Ensure Guest Account Is Disabled

높음레벨 1자동macos

설명

The guest account allows users access to the system without having to create an account or password. Guest users are unable to make setting changes and cannot remotely login to the system. All files, caches, and passwords created by the guest user are deleted upon logging out.

점검 방법

감사 방식: 셸 명령

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('DisableGuestAccount'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX').objectForKey('EnableGuestAccount'))
  let pref3 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow').objectForKey('GuestEnabled'))
  if ( ( pref1 == 1 && pref2 == 0 ) || ( pref3 == 0 ) ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

예상 출력: true

조치 방법

조치 방식: 가이드 또는 인프라 패치

Profile (preferred): com.apple.MCX DisableGuestAccount = <true/>; com.apple.MCX EnableGuestAccount = <false/>. Terminal: sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool false. GUI: System Settings > Users & Groups > i next to the Guest User > Set Allow guests to log in to this computer to disabled.

속성

운영 체제: macos-26
태그: macossystem-settings
참고 자료: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 2.13.1 Ensure Guest Account Is Disabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target macos