The OS X system must be configured with the prompt for Apple ID and iCloud disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-76127	AOSX-12-001125	SV-90815r1_rule		Medium

Description
The prompt for Apple ID and iCloud must be disabled, as it might mislead new users into creating unwanted Apple IDs and iCloud storage accounts upon their first logon.

STIG	Date
Apple OS X 10.12 Security Technical Implementation Guide	2018-01-04

Details

Check Text ( C-75813r1_chk )
To check if the prompt for "Apple ID" and "iCloud" are disabled for new users, run the following command: /usr/bin/sudo /usr/bin/defaults read /System/Library/User\ Template/English.lproj/Library/Preferences/com.apple.SetupAssistant If there is no result, if it prints out that the domain "does not exist", or the results do not include "DidSeeCloudSetup = 1 AND LastSeenCloudProductVersion = 10.12", this is a finding.

Check Text ( C-75813r1_chk )

To check if the prompt for "Apple ID" and "iCloud" are disabled for new users, run the following command:

/usr/bin/sudo /usr/bin/defaults read /System/Library/User\ Template/English.lproj/Library/Preferences/com.apple.SetupAssistant

If there is no result, if it prints out that the domain "does not exist", or the results do not include "DidSeeCloudSetup = 1 AND LastSeenCloudProductVersion = 10.12", this is a finding.

Fix Text (F-82765r1_fix)
This setting is enforced using the "Disable iCloud Policy" configuration profile.