id: pwpolicy_account_inactivity_enforce
title: Disable Accounts after $ODV Days of Inactivity
discussion: |
  The macOS _MUST_ be configured to disable accounts after $ODV days of inactivity.

  This rule prevents malicious users from making use of unused accounts to gain access to the system while avoiding detection.
check: |
  /usr/bin/pwpolicy -getaccountpolicies 2> /dev/null | /usr/bin/tail +2 | /usr/bin/xmllint --xpath '//dict/key[text()="policyAttributeInactiveDays"]/following-sibling::integer[1]/text()' -
result:
  integer: $ODV
fix: |
  This setting may be enforced using local policy or by a directory service.

  To set local policy to disable an inactive user after $ODV days, edit the current password policy to contain the following <dict> within the "policyCategoryAuthentication":

  [source,xml]
  ----
  <dict>
  <key>policyContent</key>
  <string>policyAttributeLastAuthenticationTime &gt; policyAttributeCurrentTime - (policyAttributeInactiveDays * 24 * 60 * 60)</string>
  <key>policyIdentifier</key>
  <string>Inactive Account</string>
  <key>policyParameters</key>
  <dict>
  <key>policyAttributeInactiveDays</key>
  <integer>$ODV</integer>
  </dict>
  </dict>
  ----
  After saving the file and exiting to the command prompt, run the following command to load the new policy file, substituting the path to the file in place of "$pwpolicy_file".

  [source,bash]
  ----
  /usr/bin/pwpolicy setaccountpolicies $pwpolicy_file
  ----
  NOTE: See the password policy supplemental on more information on how to implement password policies on macOS.
references:
  cce:
    - CCE-94330-8
  cci:
    - CCI-000795
    - CCI-003627
    - CCI-003628
  800-53r5:
    - AC-2(3)
  800-53r4:
    - IA-4
  srg:
    - SRG-OS-000118-GPOS-00060
    - SRG-OS-000590-GPOS-00110
  disa_stig:
    - APPL-15-003080
  800-171r3:
    - 03.01.01
  cis:
    benchmark:
      - N/A
    controls v8:
      - 5.3
  cmmc:
    - IA.L2-3.5.6
macOS:
  - '15.0'
odv:
  hint: Number of days.
  recommended: 35
  stig: 35
tags:
  - 800-171
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-53r5_moderate
  - 800-53r5_high
  - cisv8
  - cnssi-1253_high
  - cmmc_lvl2
  - stig
  - cnssi-1253_moderate
severity: medium
mobileconfig: false
mobileconfig_info:
