Title

The macOS system must be integrated into a directory services infrastructure. (Cat I impact)

Discussion

Distinct user account databases on each separate system cause problems with username and password policy enforcement. Most approved directory services infrastructure solutions allow centralized management of users and passwords.

Check Content

If the system is using a mandatory Smart Card Policy, this is Not Applicable. To determine if the system is integrated to a directory service, run the following command: /usr/bin/dscl localhost -list . | /usr/bin/grep "Active Directory" If no results are returned, this is a finding.

Fix Text

Integrate the system into an existing directory services infrastructure.

Additional Identifiers

Rule ID: SV-252447r816155_rule

Vulnerability ID: V-252447

Group Title: SRG-OS-000480-GPOS-00227

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.