The macOS system must disable the guest account.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259511	APPL-14-002063	SV-259511r941155_rule		Medium

Description
Guest access must be disabled. Turning off guest access prevents anonymous users from accessing files.

STIG	Date
Apple macOS 14 (Sonoma) Security Technical Implementation Guide	2024-01-10

Details

Check Text ( C-63250r941153_chk )
Verify the macOS system is configured to disable the guest account with the following command: /usr/bin/osascript -l JavaScript << EOS function run() { let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('DisableGuestAccount')) let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\ .objectForKey('EnableGuestAccount')) if ( pref1 == true && pref2 == false ) { return("true") } else { return("false") } } EOS If the result is not "true", this is a finding.

Check Text ( C-63250r941153_chk )

Verify the macOS system is configured to disable the guest account with the following command:

/usr/bin/osascript -l JavaScript << EOS
function run() {
let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\
.objectForKey('DisableGuestAccount'))
let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.MCX')\
.objectForKey('EnableGuestAccount'))
if ( pref1 == true && pref2 == false ) {
return("true")
} else {
return("false")
}
}
EOS

If the result is not "true", this is a finding.

Fix Text (F-63158r941154_fix)
Configure the macOS system to disable the guest account by installing the "com.apple.MCX" configuration profile.