Overview

The Apple Login Window Policy lets you configure how the macOS login window behaves on managed devices. You can control:

Which users or groups are allowed or denied
Guest, local, mobile, and network account visibility
Login prompts (user list vs. username/password)
Banners and extra information on the login screen
Power, restart, sleep, and logout options
Security options like console access and automatic login
Supported platform: macOS
Minimum OS version: macOS 10.7+ (some fields require newer macOS versions)
Policy link: https://help.swif.ai/en/articles/11997160-apple-login-window-policy

All field names below use the UI label (fieldDisplayName).

1. Login Window Display & Banner

Show additional information in the menu bar

Displays extra system information in the menu bar at the login window (e.g., when clicking the time area).

Value type: String
Options:
- HostName
- SystemVersion
- IPAddress
Default: Not configured

Banner

Text displayed on the login window, often used for legal or security notices.

Value type: String
Value: Any text
Default: Not configured

Show input menu in login window

(macOS 10.8+)
Shows the macOS input/keyboard menu at the login screen.

Values: true / false
Default: false

2. Access Control: Allowed, Denied & Hidden Users

Allowed Users or Groups

Defines which users or groups can log in.

Value type: Array of strings
Value: User GUIDs or group GUIDs
* (asterisk) allows all users or groups
Default: Not configured

Denied Users or Groups

Users or groups that cannot log in. This list takes priority over Allowed Users or Groups.

Value type: Array of strings
Value: User GUIDs or group GUIDs
Default: Not configured

Hidden Users List

Hides specific users from the login window. These users can still log in via Other….

Value type: Array of strings
Value: Usernames
Default: Not configured

Root login to disable

Prevents direct root login, requiring a normal user login before privilege escalation.

Values: true / false
Default: false

3. Local, Mobile & Network Account Visibility

Hide local users

Shows only network and system users in the login user list (local users are hidden).

Values: true / false
Default: false

Hide mobile accounts

Hides mobile account users in the user list. (In some configurations, mobile users may appear as network users.)

Values: true / false
Default: false

Show network users

Displays network directory users (e.g., AD/LDAP) in the user list.

Values: true / false
Default: false

Local-only users may log in

Controls whether local-only users are allowed to log in.

Values: true / false
Default: false

Enable external accounts

Allows external accounts to log in.

Values: true / false
Default: true

Local-only users use available workgroup settings

Applies workgroup configuration to local-only users.

Values: true / false
Default: false

4. Guest Account & Lock Message

Guest account to disable

Controls the macOS Guest account, which is often recommended to be disabled in secure environments.

Value type: String
Options:
- Not Configured
- Enabled
- Disabled
Default: Not Configured

Disallow user to set lock message

(macOS 10.10+)
Prevents users from changing the lock screen message.

Values: true / false
Default: false

5. Login Prompt & Password Behavior

Login window prompt configuration

Configure the system to prompt for both username and password at the login window, rather than displaying a user list.

Values:
- false – Show a user list
- true – Require username and password entry
Default: false

Login to other user sessions

Shows the Other… option, allowing login as a user not listed on the screen (including hidden ones).

Values: true / false
Default: false

Disallow user to change password

Blocks users from changing their own password via macOS UI.

Values: true / false
Default: false

Retries Until Hint

Controls when password hints appear after failed login attempts.

Value type: Integer
Minimum: 0
0 = disable password hints
Default: Not configured

6. Workgroup & Directory Behavior

Always Show Workgroup Dialog during log in

Always displays the workgroup dialog during login.

Values: true / false
Default: false

Combine available workgroup settings

Combines workgroup settings when a user belongs to more than one workgroup.

Values: true / false
Default: false

Ignore workgroup nesting

Ignores nested workgroup structure (flattens workgroup hierarchy).

Values: true / false
Default: false

Local-only users use available workgroup settings

Uses workgroup settings for local-only accounts.

Values: true / false
Default: false

7. Security: Console & Automatic Login

Disable -> Console Access

Disables access to the special >console login (command-line only UI).

Values: true / false
Default: true

Disable automatic login if FileVault is enabled

(macOS 10.9+)
Blocks automatic login when FileVault disk encryption is turned on.

Values: true / false
Default: false

Disable the immediate Screen Lock function

(macOS 10.13+)
Disables immediate screen lock actions.

Values: true / false
Default: false

8. Power, Restart, Sleep & Logout Controls

These settings control which actions are visible or usable on the login screen or while logged in.

Hide the Shut Down button

Removes the Shut Down button from the login window.

Values: true / false
Default: false

Disable the Shut Down menu item while logged in

Prevents users from shutting down the Mac from the menu when logged in.

Values: true / false
Default: false

Hide the restart button

Hides the Restart button on the login window.

Values: true / false
Default: false

Disable the Restart menu item while logged in

Prevents users from restarting from the menu when logged in.

Values: true / false
Default: false

Hide the Sleep Button

Hides the Sleep button on the login window.

Values: true / false
Default: false

Disable the Power Off menu item while logged in

Disables the Power Off item in the menu while a user is logged in.

Values: true / false
Default: false

Disable the Log Out menu item while logged in

(macOS 10.13+)
Prevents users from logging out via the menu when logged in.

Values: true / false
Default: false

Reopen windows when logging back in

Controls whether macOS reopens previously open windows when the user logs back in.

Values: true / false
Default: true

9. Computer Name & Management Controls

Mac computer adminstrators may refresh content or disable management

Allows Mac administrators to refresh management content or disable management.

Values: true / false
Default: true

Set Mac computer name to computer record name

Keeps the Mac’s hostname in sync with its directory/computer record.

Values: true / false
Default: true

Recommended Defaults for Security

For enterprise security hardening, Swif.ai recommends:

Field	Recommended Value	Reason
Guest account to disable	Disabled	Prevents anonymous access
Root login to disable	true	Blocks direct root login
Login window prompt configuration	true	Hides user list to avoid user enumeration
Login to other user sessions	false	Blocks Other… which allows logging into hidden accounts.

Summary

The Apple Login Window Policy provides deep control over how macOS handles login flow, user visibility, authentication behavior, and security posture. With extensive fields and configurable options, it enables fine-grained alignment with enterprise security standards.