Catalina - Require Administrator Password to Modify System-Wide Preferences

Information

The system _MUST_ be configured to require an administrator password in order to modify the system-wide preferences in System Preferences.

Some Preference Panes in System Preferences contain settings that affect the entire system. Requiring a password to unlock these system-wide settings reduces the risk of a non-authorized user modifying system configurations.

Solution

[source,bash]
----
/usr/bin/security authorizationdb read system.preferences > /tmp/system.preferences.plist
/usr/libexec/PlistBuddy -c "Set :shared false" /tmp/system.preferences.plist
/usr/bin/security authorizationdb write system.preferences < /tmp/system.preferences.plist
----

See Also

https://github.com/usnistgov/macos_security

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION

References: 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(2), 800-53|IA-3, CCE|CCE-84937-2, CCI|CCI-001958, STIG-ID|AOSX-15-002069

Plugin: Unix

Control ID: be4f7182de29e3a6d6397f685b92c92dab8e0250a3353c709f6fd4ec00b24dce