Monterey - Require Administrator Password to Modify System-Wide Preferences

Information

The system _MUST_ be configured to require an administrator password in order to modify the system-wide preferences in System Preferences.

Some Preference Panes in System Preferences contain settings that affect the entire system. Requiring a password to unlock these system-wide settings reduces the risk of a non-authorized user modifying system configurations.

Solution

[source,bash]
----
/usr/bin/security authorizationdb read system.preferences > /tmp/system.preferences.plist
/usr/libexec/PlistBuddy -c "Set :shared false" /tmp/system.preferences.plist
/usr/bin/security authorizationdb write system.preferences < /tmp/system.preferences.plist
----

See Also

https://github.com/usnistgov/macos_security

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(2), CCE|CCE-91079-4

Plugin: Unix

Control ID: df0f2bb5fa7a4efadb9e75f9d724d054a62c1edaf2a6e900665d5f2ed8c20c8b