Detections
Analytics
2.2.1 Ensure 'Set time and date automatically' Is Enabled
Information
Correct date and time settings are required for authentication protocols, file creation, modification dates, and log entries.Note: If your organization has internal time servers, enter them here. Enterprise mobile devices may need to use a mix of internal and external time servers. If multiple servers are required, use the Date & Time System Preference with each server separated by a space.
Additional Note: The default Apple time server is time.apple.com. Variations include time.euro.apple.com. While it is certainly more efficient to use internal time servers, there is no reason to block access to global Apple time servers or to add a time.apple.com alias to internal DNS records. There are no reports that Apple gathers any information from NTP synchronization, as the computers already phone home to Apple for Apple services including iCloud use and software updates. Best practice is to allow DNS resolution to an authoritative time service for time.apple.com, preferably to connect to Apple servers, but local servers are acceptable as well.
Rationale:
Kerberos may not operate correctly if the time on the Mac is off by more than 5 minutes. This in turn can affect Apple's single sign-on feature, Active Directory logons, and other features.
Impact:
The timed service will periodically synchronize with named time servers and will make the computer time more accurate.
Solution
Graphical Method:Perform the following steps to enable the date and time to be set automatically:
Open System Preferences
Select Date & Time
Set Set date and time automatically to enabled
Note: By default, the operating system will use time.apple.com as the time server. You can change to any time server that meets your organization's requirements.
Terminal Method:
Run the following commands to enable the date and time setting automatically:
$ /usr/bin/sudo /usr/sbin/systemsetup -setnetworktimeserver <your.time.server>
setNetworkTimeServer: <your.time.server>
$ /usr/bin/sudo /usr/sbin/systemsetup -setusingnetworktime on
setUsingNetworkTime: On
example:
$ /usr/bin/sudo /usr/sbin/systemsetup -setnetworktimeserver time.apple.com
setNetworkTimeServer: time.apple.com
$ /usr/bin/sudo /usr/sbin/systemsetup -setusingnetworktime on
setUsingNetworkTime: On
Run the following commands if you have not set, or need to set, a new time zone:
$ /usr/bin/sudo /usr/sbin/systemsetup -listtimezones
$ /usr/bin/sudo /usr/sbin/systemsetup -settimezone <selected time zone>
example:
$ /usr/bin/sudo /usr/sbin/systemsetup -listtimezones
Time Zones:
Africa/Abidjan
Africa/Accra
...
Pacific/Wake
Pacific/Wallis
$ /usr/bin/sudo /usr/sbin/systemsetup -settimezone America/New_York
Set TimeZone: America/New_York
Additional Information:
To learn more about timed, read: Has anyone got the time? How High Sierra has changed time synchronisation
Note: The profile configuration has been removed since it requires a specific time server to be set.
See Also
Item Details
Audit Name: CIS Apple macOS 11.0 Big Sur v4.0.0 L1
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-7, 800-53|AU-8, CSCv7|6.1
Plugin: Unix
Control ID: a981b16b16e23628ab9d4f2abae9acf3086d988b55f53aba90825cbdc1277fdd