User Preferences Revert to Defaults Following Reboot #49

New Issue

michael · 2026-01-19T18:29:03Z

michael commented

2026-01-19 18:29:03 +00:00

Originally created by @narender34 on GitHub.

After executing the compliance script with the --fix flag, I have observed that certain user settings—such as Appearance (Dark/Light mode), 24-hour time format, Trackpad scroll direction, "Shake mouse pointer to locate," and the "Prefer tabs when opening documents" option—are reverted to their default values following a system reboot.

Originally created by @narender34 on GitHub. After executing the compliance script with the --fix flag, I have observed that certain user settings—such as Appearance (Dark/Light mode), 24-hour time format, Trackpad scroll direction, "Shake mouse pointer to locate," and the "Prefer tabs when opening documents" option—are reverted to their default values following a system reboot.

michael closed this issue

2026-01-19 18:29:03 +00:00

michael commented

2026-01-19 18:29:03 +00:00

@narender34 commented on GitHub:

The Issue has now been resolved. I updated our compliance script to ensure that the AppleShowAllExtensions setting is applied to all local accounts, as required. This preference must be configured within the user context, which I had initially overlooked—the script was executed as root, leading to the issue. I was able to resolve it by removing the ~/Library/Preferences/.GlobalPreferences.plist file and rebooting the system. Both our audit tools and CIS benchmarks recommend verifying this control across all local account preferences. Previously, our script only applied the setting to the currently logged-in user. Since we have a local management account created during PreStage, this account was failing the CIS 6.1.1 check: "Ensure Show All Filename Extensions Settings is Enabled." It would be nice if CIS benchmark is updated to check this control for current logged in user instead of all local accounts.

@narender34 commented on GitHub: The Issue has now been resolved. I updated our compliance script to ensure that the AppleShowAllExtensions setting is applied to all local accounts, as required. This preference must be configured within the user context, which I had initially overlooked—the script was executed as root, leading to the issue. I was able to resolve it by removing the ~/Library/Preferences/.GlobalPreferences.plist file and rebooting the system. Both our audit tools and CIS benchmarks recommend verifying this control across all local account preferences. Previously, our script only applied the setting to the currently logged-in user. Since we have a local management account created during PreStage, this account was failing the CIS 6.1.1 check: "Ensure Show All Filename Extensions Settings is Enabled." It would be nice if CIS benchmark is updated to check this control for current logged in user instead of all local accounts.

michael commented

2026-01-19 18:29:03 +00:00

@brodjieski commented on GitHub:

Hello! I'm happy to hear that you were able to resolve your issue. Looking into the rule for os_show_filename_extensions_enable, both the check and the fix command is targeting the $CURRENT_USER, so any changes to the .GlobalPreferences.plist file should be done in that user's context.

Do you have the compliance script example that isn't working as expected? I would be curious to see why it would be failing.

@brodjieski commented on GitHub: Hello! I'm happy to hear that you were able to resolve your issue. Looking into the rule for `os_show_filename_extensions_enable`, both the check and the fix command is targeting the `$CURRENT_USER`, so any changes to the `.GlobalPreferences.plist` file should be done in that user's context. Do you have the compliance script example that isn't working as expected? I would be curious to see why it would be failing.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: usnistgov/macos_security#49