cookie alert

We use cookies to offer you a better browsing experience, analyze site traffic, personalize content, and serve targeted advertisements. If you continue to use this site, you consent to our use of cookies.

Nexthink Library

macOS – Ensure Compliance State

Back

macOS – Ensure Compliance State

Latest Version: 3.0.0.0
|
Updated on April 15, 2024
Install

Description

Reducing security risks starts at keeping devices secure - because prevention is better than cure.

The problem is that most EUC teams cannot confidently report on the device landscape's compliance level, struggling to comply with security or compliance frameworks to prove that their companies are secure and reliable. This is also true for macOS, as teams managing Apple devices must be able to effortlessly report and provide proof of their compliance, whether for themselves, auditors or customers.

macOS - Ensure Compliance State Library Pack solves this by providing IT and security teams with immediate visibility into their macOS compliance state thanks to a set of Data Collection Remote Actions. On top of that, it also comes with a set of Remediation Remote Actions, enabling to quickly change settings, which critically reduces security risk and reinforces compliance.

Versions

  • 3.0.0.0 - 15 Apr 2024 - Added 'Get macOS updates and restart information' Remote Action
  • 2.1.1.0 - 29 Sep 2023 - Removed signature from "Set XProtect Status" Remote Action and added link to self signing process in documentation
  • 2.1.0.0 - 05 Sep 2022 - Removed signature of "Disable User Account", "Set Automatic Updates" and "Set Firewall Options" Remote Actions
  • 2.0.0.0 - 31 Aug 2022 - Added "Disable User Account", "Disable Guest Account", "Disable Root Account", "Set Auto Updates", "Set Firewall Options", "Set XProtect Status" and "Remove Auto Login" Remote Actions
  • 1.0.2.0 - 22 Jul 2022 - Updated OS requirements
  • 1.0.1.0 - 22 Jul 2022 - Removed special characters from documentation in "Get Auto Login Status", "Get XProtect Status" and "Get Automatic Updates Status" Remote Actions
  • 1.0.0.0 - Initial release

Required Products

Nexthink Act

Platforms

MacOS Catalina and newer

Compatibility

V6.30 and later

This Might Interest You

Workflow: Windows 11 migration
New

Orchestrate the Windows 11 migration process with automated compatibility checks and pre-to-post migration user engagement.

Released on April 11, 2024
View Library Pack

Workflow: Device assignment verification
New

Orchestrate the verification and update of device assignee information in the ServiceNow Hardware Asset Management database through a dedicated workflow.

Released on April 10, 2024
View Library Pack

Get Accounts Information

Script Description

This Remote Action reports standard and administrator user accounts names and their count. It also reports if Guest or root accounts are enabled.

Execution context and suggested scheduling

Run the script as 'interactive user'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
Total Admin Accounts Int Total number of user accounts that belong to the admin group
Total Standard Accounts Int Total number of accounts that are standard users
Root Account Enabled Bool True if the root user account is enabled. False otherwise
Guest Account Enabled Bool True if the Guest account is enabled. False otherwise
Admin Account Names StringList List of admin account names found in the device
Standard Account Names StringList List of standard user account names found in the device

Test Scenarios

UserAccountsInformationRetrievedSuccessfully
Test Case All outputs have valid values for user accounts information
Environment VM macOS x64 English 10.14, 10.15, 11, 12
Results Successful - Settings are retrieved

Get Auto Login Status

Script Description

Reports the settings applied in System Preferences - Users and Groups - Login Options - Automatic login.

Execution context and suggested scheduling

Run the script as 'interactive user'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
Auto Login User String Indicates which user has Auto Login configured
Auto Login Enabled Bool Indicates if Auto Login is enabled or not

Test Scenarios

AutoLoginIsEnabled
Test Case Auto Login is enabled
Environment VM macOS 10.14, 10.15, 11, 12
Results Success - The outputs show that Auto Login is enabled and which user is set.
AutoLoginIsDisabled
Test Case Auto Login is disabled
Environment VM macOS 10.14, 10.15, 11, 12
Results Success - The outputs show that Auto Login is disabled.
AutoLoginPlistIsNotPresent
Test Case Auto Login plist file does not exist in the target device
Environment VM macOS 10.14, 10.15, 11, 12
Results Failure - The Remote Action fails and exits with the proper message.

Get Automatic Updates Status

Script Description

Reports the settings applied in System Preferences - Software Updates.

Execution context and suggested scheduling

Run the script as 'interactive user'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
Automatic Check Enabled Bool Whether automatic background check for macOS software updates is enabled or not
Automatic Download Enabled Bool Whether automatic download of macOS software updates is enabled or not
Automatically Install Mac Os Updates Enabled Bool Whether the automatic installation of macOS updates is enabled or not
App Store Updates Enabled Bool Whether automatic background check for applications installed through App Store is enabled or not
System Updates Enabled Bool Whether automatic download and installation of XProtect, MRT and Gatekeeper updates is enabled or not

Test Scenarios

SoftwareUpdatesSettingsAreRetrievedSuccessfully
Test Case All outputs have the value of the settings retrieved
Environment VM macOS x64 English 10.14, 10.15, 11, 12
Results Successful - Settings are retrieved
SoftwareUpdatesPlistFileDoesNotExist
Test Case Plist file is not found on target device
Environment VM macOS 10.14, 10.15, 11, 12
Results Failure - The Remote Action fails and exits with the proper message

Get Encryption Information

Script Description

Gets an APFS file system disk encryption and decryption information in addition to checking whether FileVault is enabled or not.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
Protection Status String Indicates whether the disk is encrypted or decrypted
Encryption Method String Holds the method which was used to encrypt the disk (if applicable)
File Vault Is Enabled Bool Indicates whether FileVault is enabled or not on the device

Get Firewall Options

Script Description

Indicates if Firewall is enabled and the options that are applied.

Execution context and suggested scheduling

Run the script as 'interactive user'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
Enabled Bool Indicates if Firewall is enabled
Block All Connections Bool Indicates if the option Block All Connections is enabled
Allow Signed Bool Indicates if the option Allow Signed is enabled
Allow Download Signed Bool Indicates if the option Allow Download Signed is enabled
Stealth Mode Bool Indicates if the option Stealth Mode is enabled

Further Information

In case "Firewall" is disabled or "Block all incoming connections" is enabled, remaining options' status will persist but will not be used by the operating system.
This is done this way so that the previous state can be restored in case "Firewall" is enabled again, or "Block all incoming connections" is disabled.
For instance, if "AllowSigned" is set to true but "Firewall" is set to false, "AllowSigned" is not actually in place since the Firewall is disabled.

Test Scenarios

FirewallOptionsAreObtained
Test Case All the Firewall options are obtained from target device
Environment VM macOS 10.14, 10.15, 11, 12
Results Success - All the outputs can be obtained
FirewallIsDisabled
Test Case Firewall is disabled
Environment VM macOS 10.14, 10.15, 11, 12
Results Success - All the outputs reflect the options in the last configuration before Firewall was disabled
FirewallPlistIsNotPresent
Test Case Firewall plist file does not exist in the target device
Environment VM macOS 10.14, 10.15, 11, 12
Results Failure - The Remote Action fails and exits with the proper message

Get XProtect Status

Script Description

Reports the settings applied in System Preferences - Software Update - Advanced - Install system data files and security updates.

Execution context and suggested scheduling

Run the script as 'interactive user'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
Update Enabled Bool Indicates if XProtect is enabled
Last Update DateTime Indicates the XProtect last update date

Restrictions

Test Scenarios

XProtectIsEnabled
Test Case XProtect is enabled in the target device
Environment VM macOS 10.15, 11, 12
Results Success - All the outputs can be obtained
XProtectLastUpdateDateCannotBeObtained
Test Case XProtect was never updated or this information is not available on target device
Environment VM macOS 10.15, 11, 12
Results Failure - LastUpdate output shows default date (01-01-1970) and an error is shown in Execution Status Details

Set Auto Updates

Script Description

Sets the advanced options for macOS automatic updates under System Preferences - Software Update - Advanced

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
Automatic Check Enables or disables 'Check for updates' setting. Available options are 'Enable', 'Disable' or '-'
Automatic Download Enables or disables 'Download new updates when available' setting. Available options are 'Enable', 'Disable' or '-'
Automatically Install macOS Updates Enables or disables 'Install macOS Updates' setting. Available options are 'Enable', 'Disable' or '-'
Auto Update App Store Enables or disables 'Install app updates from the App store' setting. Available options are 'Enable', 'Disable' or '-'

Outputs

None.

Restrictions

Test Scenarios

AutoUpdateSettingsEnabled
Test Case Auto update settings are successfully enabled on the target device
Environment macOS 10.14, 10.15, 11, 12
Results Success - Auto update settings are enabled

Set Firewall Options

Script Description

Allows to configure the Firewall settings under System Preferences - Security and Privacy - Firewall

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
Firewall Status Enables or disables firewall for the endpoint. BlockAllConnections option blocks all incoming connections except basic services such as DHCP and IPSec
Allow Signed Allow or refuse built-in software to receive incoming connections
Allow Download Signed Allow or refuse downloaded signed software to provide services accessed form the network
Stealth Mode Allows or rejects ICMP connections to the computer

Outputs

None.

Restrictions

Further Information

Any option given is ignored by the system while FirewallStatus option is set to Disable or BlockAllConnections.

Test Scenarios

FirewallOptionsAreSet
Test Case All Firewall options given were configured successfully on the target device
Environment VM macOS 10.14, 10.15, 11, 12
Results Success - All the outputs can be obtained
FirewallOptionsCanNotBeSet
Test Case Errors occurred when trying to set any firewall option
Environment VM macOS 10.14, 10.15, 11, 12
Results Failure - The Remote Action fails and exits with the proper message

Set XProtect Status

Script Description

Allows to configure the XProtect status under System Preferences - Software Update - Advanced

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
XProtect Status Allows to enable or disable XProtect on the device

Outputs

None.

Restrictions

Test Scenarios

XProtectStatusEnabled
Test Case XProtect status is successfully enabled on the target device
Environment macOS 10.15, 11, 12
Results Success - XProtect status is enabled
XProtectStatusDisabled
Test Case XProtect status is successfully disabled on the target device
Environment macOS 10.15, 11, 12
Results Success - XProtect status is disabled

Remove Auto Login

Script Description

Removes the auto login feature configured in System Preferences - Users and Groups - Login Options - Automatic login.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

None.

Test Scenarios

AutoLoginIsRemoved
Test Case Auto Login is removed
Environment VM macOS 10.14, 10.15, 11, 12
Results Success - The Remote Action executes successfully
AutoLoginCanNotBeRemoved
Test Case Auto Login can't be removed
Environment VM macOS 10.14, 10.15, 11, 12
Results Failure - The Remote Action fails and exists with the proper message
AutoLoginPlistIsNotPresent
Test Case Auto Login plist file does not exist in the target device
Environment VM macOS 10.14, 10.15, 11, 12
Results Failure - The Remote Action fails and exits with the proper message.

Disable Guest Account

Script Description

Disables guest account if it is previously enabled.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

None.

Test Scenarios

DisabledGuestAccount
Test Case Guest account is successfully disabled on the target device
Environment macOS 10.14, 10.15, 11, 12
Results Success - Guest account is disabled
GuestAccountIsAlreadyDisabled
Test Case Guest account is already disabled on the target device
Environment macOS 10.14, 10.15, 11, 12
Results Success - Guest account is already disabled

Disable Root Account

Script Description

Disables root account in macOS endpoints if it is previously enabled.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

None.

Test Scenarios

DisabledRootAccount
Test Case Root account is successfully disabled on the target device
Environment macOS 10.14, 10.15, 11, 12
Results Success - Root account is disabled
RootAccountIsAlreadyDisabled
Test Case Root account is already disabled on the target device
Environment macOS 10.14, 10.15, 11, 12
Results Success - Root account is already disabled

Disable User Account

Script Description

Disables user account specified as input parameter.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
User To Disable User which is going to be disabled on the endpoint

Outputs

None.

Restrictions

Further Information

If the account is already disabled, a message will be displayed as part of the execution's output.
The account will be disabled even if the user is logged in the device.
This Remote Action does not delete the account and the corresponding user home folder.

Test Scenarios

DisabledAccount
Test Case Account is successfully disabled on the target device
Environment macOS 10.14, 10.15, 11, 12
Results Success - Account is disabled
AccountIsAlreadyDisabled
Test Case Account is already disabled on the target device
Environment macOS 10.14, 10.15, 11, 12
Results Success - Account is already disabled
AccountDoesNotExist
Test Case Account does not exist on the target device
Environment macOS 10.14, 10.15, 11, 12
Results Failure - Account does not exist

Get macOS updates and restart information

Script Description

This Remote Action is only supported on macOS.

This Remote Action assists organizations who have macOS devices by giving you insights into your macOS software updates status - understanding where devices have pending updates or restarts, giving insights into which updates are pending and if they require a restart as well as the amount of disk space required.The Remote Action will also output the number of days since the device was last restarted.

Execution context and suggested scheduling

Run the script as 'interactive user'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
restart pending Bool Is there a restart pending on the device
days since last restart Int The number of days since the device was last restarted
updates pending Bool Does the device have any macOS updates available and pending
names updates pending String The names of the macOS updates which are available and pending
pending security update String The name of the macOS security update which is pending installation on the device
installed build version String The current installed build version of macOS on the device
pending updates need restart Bool Whether one of the pending updates required a restart or not
disk space required for updates Size The amount of disk space required to apply all the pending updates

Further Information

Customers using this Remote Action should be aware of the following:

The 'restart pending' output is specifically related to whether a restart is pending which is caused by the installation of a Software Update (and not any other reasons that could require a restart).
The 'updates pending' output we execute the command 'softwareupdate -l' and if the result is 'Software Update found' we mark the output as TRUE.
The 'names updates pending' output works by taking the output of the 'softwareupdate -l' command and parsing the output to get the names of the updates which are pending.
The 'pending security update' output works by taking the output of the 'softwareupdate -l' command and parsing the output to get the security update with the version and build number.
The 'installed build version' output works by taking the output of the 'sw_vers' command and parsing the output to get the build and installed version.
The 'disk space required for updates' output works by taking the size of each update as specified using the 'software update -l' command, the sizes of each update are then added together to achieve an estimate.
If the updates require unpacking or a swap cache on the local disk then note that this is not possible to be factored into the estimate given by the Remote Action.