id: os_unlock_active_user_session_disable
title: Disable Login to Other User's Active and Locked Sessions
discussion: |
  The ability to log in to another user's active or locked session _MUST_ be disabled.

  macOS has a privilege that can be granted to any user that will allow that user to unlock active user's sessions. Disabling the admins and/or user's ability to log into another user's active and locked session prevents unauthorized persons from viewing potentially sensitive and/or personal information.

  NOTE: Configuring this setting will change the user experience and disable TouchID from unlocking the screensaver. A configuration profile will be generated to include the setting that restores the expected behavior. You can also apply the settings using `/usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1`.

  WARNING: Do not apply this rule if your organization uses smartcards and Platform Single Sign-On (PSSO).
references:
  nist:
    cce:
      macos_27:
        - CCE-XXXXX-X
      macos_26:
        - CCE-95328-1
      macos_15:
        - CCE-94322-5
      macos_14:
        - CCE-92919-0
    800-53r5:
      - IA-2
      - IA-2(5)
    800-171r3:
      - 03.05.01
  disa:
    cci:
      - CCI-000764
      - CCI-000770
      - CCI-004045
    srg:
      - SRG-OS-000109-GPOS-00056
      - SRG-OS-000104-GPOS-00051
    disa_stig:
      macos_26:
        - APPL-26-000090
      macos_15:
        - APPL-15-000090
      macos_14:
        - APPL-14-000090
    cmmc:
      - IA.L1-3.5.1
      - IA.L1-3.5.2
  bzk:
    bio:
      - 8.27
      - 8.27.01
  cis:
    benchmark:
      macos_26:
        - 5.7 (level 1)
      macos_15:
        - 5.7 (level 1)
      macos_14:
        - 5.7 (level 1)
    controls_v8:
      - 4.3
platforms:
  macOS:
    '27.0': {}
    '26.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
        - name: nlmapgov_plus
    '15.0':
      benchmarks:
        - name: cis_lvl1
        - name: cis_lvl2
        - name: disa_stig
          severity: medium
        - name: nlmapgov_plus
    enforcement_info:
      check:
        shell: |-
          RESULT="FAIL"
          SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver  2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -)

          if [[ "${SS_RULE}" == "$ODV" ]]; then
              RESULT="PASS"
          else
              PSSO_CHECK=$(/usr/bin/security -q authorizationdb read "$SS_RULE"  2>&1 | /usr/bin/xmllint --xpath '//key[.="rule"]/following-sibling::array[1]/string/text()' -)
              if /usr/bin/grep -Fxq "$ODV" <<<"$PSSO_CHECK"; then
                  RESULT="PASS"
              fi
          fi

          echo $RESULT
        result:
          string: PASS
      fix:
        shell: |-
          SS_RULE=$(/usr/bin/security -q authorizationdb read system.login.screensaver 2>&1 | /usr/bin/xmllint --xpath "//dict/key[.='rule']/following-sibling::array[1]/string/text()" -)

          if [[ "$SS_RULE" == *psso* ]]; then
              /usr/bin/security -q authorizationdb read psso-screensaver > "/tmp/psso-screensaver-mscp.plist"
              /usr/bin/sed -i.bak 's/<string>authenticate-session-owner-or-admin<\/string>/<string>$ODV<\/string>/' /tmp/psso-screensaver-mscp.plist
              /usr/bin/security -q authorizationdb write psso-screensaver-mscp < /tmp/psso-screensaver-mscp.plist
              /usr/bin/security -q authorizationdb write system.login.screensaver psso-screensaver-mscp 2>&1
          else
              /usr/bin/security -q authorizationdb write system.login.screensaver "$ODV" 2>&1
          fi
    introduced: '-1'
odv:
  hint:
    datatype: enum
    description: Refer to system.login.screensaver in /System/Library/Security/authorization.plist
    validation:
      enumValues:
        - authenticate-session-owner
        - authenticate-session-owner-or-admin
        - use-login-window-ui
  recommended: authenticate-session-owner
  cis_lvl1: authenticate-session-owner
  cis_lvl2: authenticate-session-owner
  nlmapgov_plus: authenticate-session-owner
  disa_stig: authenticate-session-owner
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-171
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - cnssi-1253_moderate
mobileconfig_info:
  - PayloadType: com.apple.loginwindow
    PayloadContent:
      - screenUnlockMode: 1
