id: os_filevault_autologin_disable
title: Disable FileVault Automatic Login
discussion: |
  If FileVault is enabled, automatic login _MUST_ be disabled, so that both FileVault and login window authentication are required.

  The default behavior of macOS when FileVault is enabled is to automatically log in to the computer once successfully passing your FileVault credentials.

  NOTE: DisableFDEAutoLogin does not have to be set on Apple Silicon based macOS systems that are smartcard enforced as smartcards are available at pre-boot.
check: |
  /usr/bin/osascript -l JavaScript << EOS
  $.NSUserDefaults.alloc.initWithSuiteName('com.apple.loginwindow')\
  .objectForKey('DisableFDEAutoLogin').js
  EOS
result:
  string: 'true'
fix: |
  This is implemented by a Configuration Profile.
references:
  cce:
    - CCE-95192-1
  cci:
    - CCI-000213
    - CCI-000366
  800-53r5:
    - AC-3
    - IA-5(13)
    - AC-2(11)
  800-53r4:
    - AC-2(11)
    - AC-3
    - IA-5(13)
  srg:
    - SRG-OS-000080-GPOS-00048
  disa_stig:
    - APPL-26-000033
  800-171r3:
    - 03.01.02
  cis:
    benchmark:
      - N/A
    controls v8:
      - 3.3
      - 6.7
  cmmc:
    - AC.L1-3.1.1
macOS:
  - '26.0'
tags:
  - 800-53r5_low
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-53r4_low
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-171
  - cisv8
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - cmmc_lvl1
  - stig
  - cnssi-1253_moderate
severity: medium
mobileconfig: true
mobileconfig_info:
  com.apple.loginwindow:
    DisableFDEAutoLogin: true
