Ensure "Allow Standard User OS Updates" is set to "Allowed"

Trung bìnhCấp 1Xem xét thủ côngintune-macos

Mô tả

This recommendation controls whether standard, non-administrative user accounts are permitted to initiate and install macOS operating system updates. When configured to "Allowed", users who are not local administrators can perform OS updates without requiring administrator intervention. To ensure devices are updated to a specific approved OS version, this configuration should be used in combination with recommendation 2.10.1.1 "Enforce Latest Software Update Version", or an acceptable substitute highlighted in the 2.10.1.1 description section. The benchmark marks this a Manual check of an Intune macOS policy setting that cannot be read from the endpoint with a script, so TMAegis lists it as a manual review item with the audit steps (the policy must be inspected in the Intune admin center or on the managed device).

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

macOS: Intune admin center: Expand the Declarative Device Management (DDM) heading; Under the Software Update Settings subheading; Verify that Allow Standard User OS Updates is present and set to Allowed. On the device: Double-click Management Profile; Under the Device Declarations section; Click Software Update Settings; Confirm Allow Standard User OS Updates is set to On

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Intune admin center: Select Declarative Device Management (DDM) then Software Update Settings; Check Allow Standard User OS Updates; On the left side of the page set Allow Standard User OS Updates to Allowed; Verify that Allow Standard User OS Updates is present and set to Allowed

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: intune-macosintunemanual-review
Tham chiếu: CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 - 2.10.4 Ensure "Allow Standard User OS Updates" is set to "Allowed"