CIS 1 Allow Touch ID to unlock your mac what needs to be deactivated?

Do you have a Restrictions payload that doesn’t “Allow Touch ID to unlock device?”
 

I found this on either the security or regulatory-compliance slack channels.  Here’s the plist for com.apple.loginwindow

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>screenUnlockMode</key>
	<integer>1</integer>
</dict>
</plist>

Thanks for the replies.. As this is being pushed out via the Compliance Rules under CIS Level 1, I think I will need to disable the rule ideally that controls the Touch ID, so it doesn’t conflict with other policies or profiles.
Thanks

Hi ​@Frosty, great question!

Looking at the config profile generated by the Compliance rules in Jamf Pro, I see the below plist.

Not sure if that helps to solve your problem - I haven’t found any CIS rule that would control login using Touch ID.

Hi JanVozenilek85
Thanks for this I'll keep looking into this, as these are the rules which I have disabled already.  2.11.3 & 2.11.4
Only as we use connect and didn’t need the ‘Centre for Internet Security Test Message’ appearing as well.

The issue is outlined in rule 5.7 right in the CIS GUI in Jamf.  It’s also outlined here:

5.7 Disable Login to Other User's Active and Locked Sessionsos_unlock_active_user_session_disable

Discussion

The ability to log in to another user’s active or locked session MUST be disabled.

macOS has a privilege that can be granted to any user that will allow that user to unlock active user’s sessions. Disabling the admins and/or user’s ability to log into another user’s active and locked session prevents unauthorized persons from viewing potentially sensitive and/or personal information.

Organization defined value

Review the /System/Library/Security/authorization.plist file for more information.

authenticate-session-owner

Great thanks daniel_behan, I will do some testing and hopefully get this sorted out.

Check out the macOS Security Project, it’s a much simpler process for dealing with CIS.

https://github.com/usnistgov/macos_security