Category filter

Configuration profile to disable guest accounts on Mac

Guest accounts allow other users to access the device temporarily without creating separate user logins. Guest users do not require a password to log in, yet the access remains limited. They cannot change any device settings, and the files they create are stored in a temporary folder that is deleted when they log out. While this feature can be useful, it can also pose a security risk by potentially granting unauthorized users access to the system, increasing the likelihood of data breaches. Moreover, guest accounts may not have the same security restrictions as regular user accounts, making it easier for users to exploit vulnerabilities. Disabling guest accounts can be an essential step in securing your device and protecting against unauthorized access.
This document provides a configuration profile to disable guest user accounts on Mac. Using Hexnode’s Deploy Custom Configuration feature, you can remotely push the custom configuration profiles to your macOS devices.

Note:

This configuration profile is supported on Mac devices running macOS 10.7 and above.

Disclaimer:

The sample configuration profiles provided below are created using various profile creator applications.

Disable guest accounts

Here is a .plist file to disable guest accounts on your macOS devices:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>DisableGuestAccount</key>
            <true/>
            <key>PayloadIdentifier</key>
            <string>com.example.myaccountpayload</string>
            <key>PayloadType</key>
            <string>com.apple.MCX</string>
            <key>PayloadUUID</key>
            <string>5d4e377c-108c-44af-a46e-97a5aac1e270</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Accounts</string>
    <key>PayloadIdentifier</key>
    <string>com.example.myprofile</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>8cd28a9d-625e-4056-bbd0-43617bb8efb7</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>PayloadContent</key>

<array>

<dict>

<key>DisableGuestAccount</key>

<true/>

<key>PayloadIdentifier</key>

<string>com.example.myaccountpayload</string>

<key>PayloadType</key>

<string>com.apple.MCX</string>

<key>PayloadUUID</key>

<key>PayloadVersion</key>

</dict>

</array>

<key>PayloadDisplayName</key>

<string>Accounts</string>

<key>PayloadIdentifier</key>

<string>com.example.myprofile</string>

<key>PayloadType</key>

<string>Configuration</string>

<key>PayloadUUID</key>

<key>PayloadVersion</key>

</dict>

</plist>

Notes:

To create and customize configuration profiles, you can use tools like Apple Configurator, Profile Manager or manually create them using text editors.
Use non-encrypted .mobileconfig, .xml, or plist files to deploy profiles across devices.
Ensure that you do not associate conflicting configurations with the devices.
Use wildcards to fetch key values from the portal.
It is recommended to manually validate the configuration profile on a system before executing it in bulk.
Hexnode will not be responsible for any damage/loss to the system on the behavior of the configuration profile.

Need more help?

Raise a Ticket

Ask Community

Chat With us