Users are complaining that some of our managed machines are randomly logging in as the local administrator account, even though we have auto-login disabled all around. Running Casper 9.6, with a fairly straightforward 10.9.x image. Any insight would be greatly appreciated. Thanks!
You might see Macs logged in as "System Administrator" if an end user has decided to go into Fast User Switching Mode.
You can disable this option centrally…let me know if you need kb on how to do that. We have the option disabled here.
Here is the command we send out to disable this behavior/option in OSX 10.7 and up:
sudo defaults write /Library/Preferences/.GlobalPreferences MultipleSessionEnabled -bool 'NO'
Substituting a YES of course reverses it.
FUS can often make a Mac appear to have been rooted--but disabling FUS can help--especially in labs/shared environments where users might not know each other the way they would in a smaller workgroup (where FUS can be a nice feature). It depends on your userbase.