Rule pwpolicy_account_inactivity_enforce can lock-out user account #38

New Issue

michael · 2026-01-19T18:29:00Z

michael commented

2026-01-19 18:29:00 +00:00

Originally created by @jmichalica on GitHub.

Summary

The password policy defined in the rule pwpolicy_account_inactivity_enforce can immediately lock out user account.

Steps to reproduce

Create a pwpolicy.xml file as described in the rule pwpolicy_account_inactivity_enforce. This will result in the file content (33 is the provided ODV):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist>
    <dict>
        <key>policyCategoryAuthentication</key>
        <array>
            <dict>
                <key>policyContent</key>
                <string>policyAttributeLastAuthenticationTime &gt; policyAttributeCurrentTime - (policyAttributeInactiveDays * 24 * 60 * 60)</string>
                <key>policyIdentifier</key>
                <string>Inactive Account</string>
                <key>policyParameters</key>
                <dict>
                    <key>policyAttributeInactiveDays</key>
                    <integer>33</integer>
                </dict>
            </dict>
        </array>
    </dict>
</plist>

Then run as root

/usr/bin/pwpolicy setaccountpolicies pwpolicy.xml

Operating System version

macOS Sonona Version 14.7.7 (23H723)

Intel or Apple Silicon

2,6 GHz 6-Core Intel Core i7

What is the current bug behavior?

User account is locked-out after policy application - user cannot log using their password anymore.

What is the expected correct behavior?

Password policy is correctly enforced, i.e. user account is locked out after ODV days of inactivity.

Relevant logs and/or screenshots

(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.)

Output of checks

See the attached screenshot.

Comment from @golbiga on this issue:

It looks like failedLoginTimestamp is not being created, so pwpolicy is possibly using creationTime , so in our testing just now creation date was 100 days so if we set to 101 days we can login, 99 locked out.

Possible fixes

User has to reset their password in the recovery mode.

Originally created by @jmichalica on GitHub.  ### Summary The password policy defined in the rule `pwpolicy_account_inactivity_enforce` can immediately lock out user account. ### Steps to reproduce Create a `pwpolicy.xml` file as described in the rule `pwpolicy_account_inactivity_enforce`. This will result in the file content (33 is the provided ODV): ``` <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist> <dict> <key>policyCategoryAuthentication</key> <array> <dict> <key>policyContent</key> <string>policyAttributeLastAuthenticationTime > policyAttributeCurrentTime - (policyAttributeInactiveDays * 24 * 60 * 60)</string> <key>policyIdentifier</key> <string>Inactive Account</string> <key>policyParameters</key> <dict> <key>policyAttributeInactiveDays</key> <integer>33</integer> </dict> </dict> </array> </dict> </plist> ``` Then run as root ``` /usr/bin/pwpolicy setaccountpolicies pwpolicy.xml ``` ### Operating System version macOS Sonona Version 14.7.7 (23H723) ### Intel or Apple Silicon 2,6 GHz 6-Core Intel Core i7 ### What is the current *bug* behavior? User account is locked-out after policy application - user cannot log using their password anymore. ### What is the expected *correct* behavior? Password policy is correctly enforced, i.e. user account is locked out after ODV days of inactivity. ### Relevant logs and/or screenshots (Paste any relevant logs - please use code blocks (```) to format console output, logs, and code as it's tough to read otherwise.) ### Output of checks See the attached screenshot. <img width="2214" height="810" alt="Image" src="https://github.com/user-attachments/assets/90f096ff-a121-4732-8ddc-213f26387b37" /> Comment from @golbiga on this issue: > It looks like failedLoginTimestamp is not being created, so pwpolicy is possibly using creationTime , so in our testing just now creation date was 100 days so if we set to 101 days we can login, 99 locked out. ### Possible fixes User has to reset their password in the recovery mode.

michael commented

2026-01-19 18:29:00 +00:00

@brodjieski commented on GitHub:

I have an Applecare ticket open for this issue. Until it gets resolved, I would recommend not applying the rule.

@brodjieski commented on GitHub: I have an Applecare ticket open for this issue. Until it gets resolved, I would recommend not applying the rule.

michael commented

2026-01-19 18:29:00 +00:00

@robertgendler commented on GitHub:

Just a data point to add.

It appears this worked properly in macOS Monterey. But macOS Big Sur stops creating or having lastLoginTime stamp isn't there.

But it appears that key exists when the account is a mobile managed account with Sequoia. But local accounts do not have that attribute

@robertgendler commented on GitHub: Just a data point to add. It appears this worked properly in macOS Monterey. But macOS Big Sur stops creating or having lastLoginTime stamp isn't there. But it appears that key exists when the account is a mobile managed account with Sequoia. But local accounts do not have that attribute

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#38