⚙️🍏💻CP - Device Security - Accounts and Login
Three quiet doors onto a Mac that nobody thinks about until an audit: the Guest session, the text console, and the Shift key that stops your agents from launching.
What this policy is about 🍏
Most macOS hardening conversations go straight to FileVault and Gatekeeper, and then stop. The login window gets skipped, because it looks like a login window and there is not much on it.
There is more on it than there looks. A Mac out of the box offers a Guest session that needs no credentials at all. It accepts >console in the username field, which drops you to a text login underneath the graphical one. And it lets anybody hold Shift while signing in to stop login items from starting, which on a managed Mac means stopping the things you deployed to start.
This policy shuts all three, and makes the login window slightly more useful for the helpdesk while it is there.
Unlike a Windows ADMX policy that writes a registry value and leaves it there, a macOS configuration profile carries its payload with it. Remove the profile and the settings go with it. No paired inverse policies are needed anywhere in the macOS baseline, which makes exception handling considerably simpler than on Windows.
Why this matters 🕵️
The Guest account is the one that surprises people. It is not a leftover or an edge case, it is on by default, and it gives anyone who opens the lid a working session on company hardware without a single credential. The session is wiped at logout, which sounds reassuring until you consider that a wiped session is also a session with no audit trail. On a Mac with FileVault enabled the Guest gets a Safari-only mode rather than a full desktop, which reduces the blast radius without making it something you want on a business machine.
Console access is the same idea one layer down. Typing >console at the login window drops to a text-mode login, which is a legitimate troubleshooting route and a perfectly good way around a graphical login window that somebody has locked down.
Login items suppression is less about attackers and more about the estate staying true. If a user can hold Shift and stop your management and security agents from launching, then your compliance reporting is describing a machine that only sometimes runs what you deployed. That is worse than knowing it does not, because it looks fine on the dashboard.
🛠️ Configuration
Where: Intune admin center → Devices → Configuration → Create → macOS → Settings catalog.
| Setting | Category | Value |
|---|---|---|
| Disable Guest Account | Accounts | True |
| Disable Console Access | Login → Login Window Behavior | True |
| Admin Host Info | Login → Login Window Behavior | HostName |
| Hide Admin Users | Login → Login Window Behavior | False |
| Disable Login Items Suppression | Login → Login Window Login Items | True |
| Assignment, include | All devices, macOS filter |
Admin Host Info is the helpdesk one. With it set to HostName, clicking the clock at the login window cycles through the machine's host information. That means a user who cannot sign in can still read the device name off the screen and give it to support, instead of the conversation where somebody is asked to find a serial number on a laptop they cannot log into. Small setting, disproportionate effect on call length. 🙂
Hide Admin Users stays False, deliberately. Hiding administrator accounts from the user list is sometimes proposed as hardening, and it is not: it is obscurity that makes local support harder while an attacker simply types the name. Leave the accounts visible and put the effort into what those accounts are allowed to do.
Disable Login Items Suppression is the one users notice least and you rely on most. It keeps your agents, sync clients and security tooling starting when the user signs in, regardless of what keys are being held down at the time.
Caveats ⚠️
On macOS the user is usually a local administrator. That is the normal shape of a Mac deployment and it is the context this policy sits in: an administrator can undo a great deal locally, and configuration profiles are enforced by MDM rather than by permissions. This policy raises the floor and removes the casual paths. It is not a containment boundary against a determined local admin, and it should not be sold as one.
Guest access has a second, unrelated meaning. Disabling the Guest account here does not affect Guest access to shared folders over SMB, which is a separate setting under file sharing. Customers who ask "have we turned off guest access" are sometimes asking about the other one.
Console access is a troubleshooting route you are giving up. Rarely used, but if an engineer is used to reaching a text login on a misbehaving Mac, tell them it is gone before they spend twenty minutes assuming the keyboard is broken.
Settings catalog for macOS delivers over MDM and, where supported, declarative device management. The Mac needs to be enrolled and the profile shows under System Settings → General → Device Management. Users can see it there, which is worth knowing before somebody asks what the company installed on their machine.
Clean-revert, genuinely. Unassign the profile and macOS removes the payload with it: Guest comes back, console access comes back, login items become suppressible again. This is the main structural difference from the Windows baseline and it is why the macOS side of this site carries no inverse policies.
👥 Assignment scope
Baseline for every managed Mac. Assign to all devices with a macOS platform filter rather than to a dedicated group, which keeps new enrolments covered without anyone having to remember to add them.
There is no exception group. If a specific machine genuinely needs the Guest session or console access, the honest answer is that it is not a managed business device, and the conversation is about what it is for rather than which setting to unassign.
Worth verifying at tenant takeover: whether any Macs already have local accounts nobody can account for. This policy closes the doors going forward; it does not audit what walked through them previously.
🔗 Related
- 🚦🟢💻CA - Require Compliant Device 🍏: the access side, which only means something once the Mac is genuinely managed.
- 🧱🪟💻ES - BitLocker: the Windows equivalent of the disk encryption story that FileVault handles on this platform.
The login window is a door, not a decoration. Three settings close the ways round it, and one makes the helpdesk's day slightly shorter. 🍏