Detections
Analytics

2.8.1 Audit Universal Control Settings

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Universal Control is an Apple feature that allows Mac users to control multiple other Macs and iPads with the same keyboard, mouse, and trackpad using the same Apple ID. The technology relies on already available iCloud services, particularly Handoff.

Universal Control simplifies the use of iCloud connectivity of multiple computers using the same Apple ID. This may simplify data transfer from organizationally-managed and personal devices. The use of the same iCloud account and Handoff is the underlying concern that should be evaluated. The use of the same keyboard or mouse across multiple devices does not by itself decrease organizational security.

Rationale:

The use of devices together when some are organizational and some are not may complicate device management standards.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Graphical Method:
Perform the following steps to set Universal Control to your organization's requirements:

Open System Preferences

Select Display

Select Advanced...

Set the options that meet your organization's requirements

Terminal Method:
Run the following command to enable or disable Universal Control:

$ /usr/bin/sudo -u <user> /usr/bin/defaults -currentHost read com.apple.universalcontrol Disable -bool <true/false>

$ /usr/bin/sudo -u <user> /usr/bin/defaults -currentHost read com.apple.universalcontrol DisableMagicEdges -bool <true/false>

example:

$ /usr/bin/sudo -u firstuser /usr/bin/defaults -currentHost read com.apple.universalcontrol Disable -bool true

$ /usr/bin/sudo -u firstuser /usr/bin/defaults -currentHost read com.apple.universalcontrol DisableMagicEdges -bool true

$ /usr/bin/sudo -u seconduser /usr/bin/defaults -currentHost read com.apple.universalcontrol Disable -bool false

$ /usr/bin/sudo -u seconduser /usr/bin/defaults -currentHost read com.apple.universalcontrol DisableMagicEdges -bool false

Profile Method:
Create or edit a configuration profile with the following information:

The PayloadType string is com.apple.universalcontrol

The key to include is Disable

Set the key to <true/> or <false/> based on your organization's requirements

Note: Since the profile method sets a system-wide setting and not a user-level one, the profile method is the preferred method. It is always better to set system-wide than per user.

Additional Information:

Universal Control: Use a single keyboard and mouse between Mac and iPad

Universal Control: Everything You Need to Know

See Also

https://workbench.cisecurity.org/files/4159

Item Details

References: CSCv7|5.1, CSCv7|9.2

Plugin: Unix

Control ID: a9003c724225cfd25a25d5aefc1d78b0f4f6a86152242fbf5866185b8d91c44f