The macOS system must be configured with the prompt for Apple ID and iCloud disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-81689	AOSX-13-001125	SV-96403r1_rule		Medium

Description
The prompt for Apple ID and iCloud must be disabled, as it might mislead new users into creating unwanted Apple IDs and iCloud storage accounts upon their first logon.

STIG	Date
Apple OS X 10.13 Security Technical Implementation Guide	2019-12-20

Details

Check Text ( C-81469r1_chk )
To check if the system is configured to skip cloud setup, run the following command: /usr/sbin/system_profiler SPConfigurationProfileDataType \| /usr/bin/grep SkipCloudSetup If “SkipCloudSetup" is not set to "1", this is a finding. To check if the prompt for "Apple ID" and "iCloud" are disabled for new users, run the following command: /usr/bin/sudo /usr/bin/defaults read /System/Library/User\ Template/English.lproj/Library/Preferences/com.apple.SetupAssistant If there is no result, if it prints out that the domain "does not exist", or the results do not include "DidSeeCloudSetup = 1 AND LastSeenCloudProductVersion = 10.12", this is a finding.

Check Text ( C-81469r1_chk )

To check if the system is configured to skip cloud setup, run the following command:

/usr/sbin/system_profiler SPConfigurationProfileDataType | /usr/bin/grep SkipCloudSetup

If “SkipCloudSetup" is not set to "1", this is a finding.

To check if the prompt for "Apple ID" and "iCloud" are disabled for new users, run the following command:

/usr/bin/sudo /usr/bin/defaults read /System/Library/User\ Template/English.lproj/Library/Preferences/com.apple.SetupAssistant

If there is no result, if it prints out that the domain "does not exist", or the results do not include "DidSeeCloudSetup = 1 AND LastSeenCloudProductVersion = 10.12", this is a finding.

Fix Text (F-88537r1_fix)
This setting is enforced using the “Login Window Policy" configuration profile.