To assure individual accountability and prevent unauthorized access, logging in as root at the login window _MUST_ be disabled. The macOS system _MUST_ require individuals to be authenticated with an individual authenticator prior to using a group authenticator, and administrator users _MUST_ never log in directly as root.