We’ve got FUS disabled through a configuration profile, but it appears the menu bar/control center extra bypasses this setting. Users can enable the extra and then use it to switch accounts.
Not a major security issue I don’t think, but my org doesn’t use FUS. Is there a way to block specific menu bar/control center extras?
Hello,
The control center/menu bar extra can sometimes bypass this. This is often due to how the com.apple.controlcenter preference domain interacts with the .GlobalPreferences domain.
To address this, you need to use a configuration profile that specifically targets and disables the FUS control center extra. The key you're looking for is UserSwitcher within the com.apple.controlcenter preference domain.
The MultipleSessionEnabled Key: This is the traditional key used to disable FUS, found in the /Library/Preferences/.GlobalPreferences plist.
However, as you've observed, on modern macOS versions (Ventura and later), it doesn't always prevent the Control Center from allowing FUS.
The UserSwitcher Key: This is the key that controls the visibility and functionality of the FUS menu bar item and the Control Center module.
It's an integer key in the com.apple.controlcenter preference domain.
To disable FUS in the Control Center, you need to set this value to 8.
Creating the Configuration Profile: You'll need to create a custom configuration profile (or a custom settings payload in your MDM solution) that targets the com.apple.controlcenter preference domain.
Add a key named UserSwitcher with an integer value of 8.
You can also include the MultipleSessionEnabled key MyWisely in the .GlobalPreferences domain and set it to false for a belt-and-suspenders approach, although the UserSwitcher key is the one that directly addresses the Control Center behavior.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.