BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

pwpolicy_temporary_accounts_disable Automatically Remove or Disable Temporary User Accounts within 72 Hours

NIST macOS Security Compliance Project Sequoia Guidance, Revision 4.0 (be5491f)
All changes in this version
first version loaded Password policy

Title

Automatically Remove or Disable Temporary User Accounts within 72 Hours

Control

The technology supports this requirement and cannot be configured to be out of compliance. The technology inherently meets this requirement.

Discussion

The macOS is able to be configured to set an automated termination for 72 hours or less for all temporary accounts upon account creation.

If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be targeted by attackers to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts _MUST_ be set to 72 hours (or less) when the temporary account is created.

If no policy is enforced by a directory service, a password policy can be set with the "pwpolicy" utility. The variable names may vary depending on how the policy was set.

If there are no temporary accounts defined on the system, this is Not Applicable.

Related controls

ac-2.2

Fix

The technology inherently meets this requirement. No fix is required.