Big Sur - Require Administrator Password to Modify System-Wide Preferences

Information

The system _MUST_ be configured to require an administrator password in order to modify the system-wide preferences in System Preferences.

Some Preference Panes in System Preferences contain settings that affect the entire system. Requiring a password to unlock these system-wide settings reduces the risk of a non-authorized user modifying system configurations.

Solution

[source,bash]
----
/usr/bin/security authorizationdb read system.preferences > /tmp/system.preferences.plist
/usr/libexec/PlistBuddy -c "Set :shared false" /tmp/system.preferences.plist
/usr/bin/security authorizationdb write system.preferences < /tmp/system.preferences.plist
----

See Also

https://github.com/usnistgov/macos_security

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(2), 800-53|IA-3, CCE|CCE-85389-5, CCI|CCI-001958, STIG-ID|APPL-11-002069

Plugin: Unix

Control ID: 25f3b9bb7802dcaea07cc76098581041abb08c494f87af2092ebccfe5a477194