Overview
The Apple Login Window Policy controls how the macOS login window looks and behaves on managed Macs. You can use it to:
choose between a user list and a name and password prompt
choose which kinds of users appear in the list
turn the Guest account on or off
add a banner and computer information to the login window
control automatic login, console access, and password hints
hide or turn off the Shut Down, Restart, Sleep, and Log Out options
Important: Turn off "Mac computer administrators may refresh content or disable management" for most fleets. Swif turns this setting on by default. According to Apple, when it's on, a local administrator can choose at login to bypass or disable managed preferences for their session. Turn it off unless your local admins need this ability.
Supported platforms and requirements
Item | Details |
Platform | macOS |
Minimum OS | macOS 10.7 or later (some settings need a later version; see the settings tables) |
Device ownership | Company-owned devices |
Supervision | Not required |
User Enrollment (BYOD) | Not supported. Apple doesn't allow the Login Window payload on User Enrollment. |
These settings apply to the whole Mac and to every user who logs in.
Settings reference
Login prompt and user list
Setting | What it does | Default | Minimum OS |
Login window prompt configuration | On: the login window asks for a user name and password. Off: it shows a list of users. | Off (user list) | macOS 10.7 |
Display administrator users at login window | On: administrator accounts appear in the user list. Off: they're hidden. | On | macOS 10.7 |
Hide local users | On: the user list shows only network and system users. | Off | macOS 10.7 |
Show network users | On: the user list includes network directory users, such as Active Directory or LDAP accounts. | Off | macOS 10.7 |
Login to other user sessions | On: the user list includes Other…, so users can type the name of an account that isn't listed. | Off | macOS 10.7 |
Local standard (non-admin) users may log in | Off: standard local users can't log in. Only administrators can, until you turn it back on or the user becomes an administrator. | On | macOS 10.7 |
The last four user-list settings only matter when Login window prompt configuration is off. With the name and password prompt, no list appears.
About the FileVault screen. On a Mac with FileVault on, the unlock screen may look different from the login window. Swif's testing found this combination shows a list of users on both screens:
Login window prompt configuration off
Display administrator users at login window on
On Apple silicon Macs with FileVault on, Swif observed that the unlock screen otherwise shows a generic name and password prompt. Test your configuration on your hardware. See FileVault's Effect on the macOS Login Window.
Guest account
Setting | What it does | Default | Minimum OS |
Guest account | On: the Guest account is available. Off: the Guest account is turned off. | Off | macOS 10.7 |
Keep the Guest account off on company Macs unless you have a specific need for anonymous access.
Login window content
Setting | What it does | Default | Minimum OS |
Banner | Text shown on the login window, such as a legal or acceptable-use notice. | Not set | macOS 10.7 |
Show additional information in the menu bar | Shows computer information on the login window: HostName, SystemVersion, or IPAddress. On macOS 10.10 and later, choosing any option lets users click the clock in the menu bar to cycle through the available information. | Not set | macOS 10.7 |
Show input menu in login window | On: shows the input (keyboard layout) menu on the login window. | Off | macOS 10.8 |
Retries Until Hint | Number of failed attempts before the password hint appears. 0 turns hints off. | Not set | macOS 10.7 |
Automatic login and access
Setting | What it does | Default | Minimum OS |
Disable automatic login if FileVault is enabled | On: after the user unlocks FileVault at startup, macOS still shows the login window and asks the user to log in again. Off: unlocking FileVault logs the user in. | Off | macOS 10.9 |
Disable automatic loging if FileVault is disabled | On: automatic login is turned off on Macs without FileVault. | On | macOS 10.7 |
Disable -> Console Access | On: macOS ignores the | On | macOS 10.7 |
Disable the immediate Screen Lock function | On: turns off the immediate Screen Lock options. | Off | macOS 10.13 |
Disallow user to change password | On: users can't change their own password. | Off | macOS 10.7 |
Disallow user to set lock message | On: users can't change the message shown on the lock screen. | Off | macOS 10.10 |
If you use the Apple Platform SSO Policy, turn on Disable automatic login if FileVault is enabled on the same Macs. Otherwise, unlocking FileVault logs the user in and the Platform SSO sign-in never appears.
Power, restart, and logout options
Setting | What it does when on | Default | Minimum OS |
Hide the Shut Down button | Turns off the Shut Down button on the login window. | Off | macOS 10.7 |
Hide the restart button | Turns off the Restart button on the login window. | Off | macOS 10.7 |
Hide the Sleep Button | Turns off the Sleep button on the login window. | Off | macOS 10.7 |
Disable the Shut Down menu item while logged in | Turns off Shut Down in the Apple menu while a user is logged in. | Off | macOS 10.7 |
Disable the Restart menu item while logged in | Turns off Restart in the Apple menu while a user is logged in. | Off | macOS 10.7 |
Disable the Power Off menu item while logged in | Turns off the Power Off item while a user is logged in. | Off | macOS 10.7 |
Disable the Log Out menu item while logged in | Turns off Log Out in the Apple menu while a user is logged in. | Off | macOS 10.13 |
These settings hide menu options only. A user can still shut down a Mac with the power button.
Session and management
Setting | What it does | Default | Minimum OS |
Reopen windows when logging back in | Sets whether macOS reopens the user's windows after they log out and back in. | On | macOS 10.7 |
Set Mac computer name to computer record name | For Macs bound to a directory, keeps the Mac's name matched to its directory computer record. | On | macOS 10.7 |
Mac computer adminstrators may refresh content or disable management | On: local administrators can refresh managed settings or bypass them for their session at login. We recommend turning this off. | On | macOS 10.7 |
Before you start
Decide on the login prompt. A name and password prompt doesn't reveal account names. A user list is easier for users who share a Mac.
Check FileVault and Platform SSO. If you use Platform SSO, plan to turn on Disable automatic login if FileVault is enabled.
Confirm an administrator can still log in. Before you turn off Local standard (non-admin) users may log in or hide administrator users, make sure someone can still log in to each Mac.
Prepare your banner text, if your organization requires a login notice.
Create the policy
In Swif, go to Device Management > Policies > New Policy.
Select Apple Login Window Policy.
Enter a clear name, such as
Mac Login Window – Standard.Set the login prompt, user list, and Guest account options.
Add a Banner and computer information if needed.
Set the automatic login, access, and power options.
Turn off Mac computer adminstrators may refresh content or disable management unless your admins need it.
Save the policy.
Assign it to a device group of Macs.
Test on a few Macs, including a restart, before a wider rollout.
Example configurations
Example 1: Company laptops
For Macs assigned to one person.
Setting | Value |
Login window prompt configuration | On (name and password) |
Guest account | Off |
Banner |
|
Retries Until Hint | 0 |
Disable -> Console Access | On |
Disable automatic loging if FileVault is disabled | On |
Mac computer adminstrators may refresh content or disable management | Off |
All other settings | Defaults |
The name prompt keeps account names off the screen. Password hints and console access are turned off.
Example 2: Laptops using Platform SSO
For Macs where users sign in with your identity provider.
Setting | Value |
Login window prompt configuration | On |
Disable automatic login if FileVault is enabled | On |
Guest account | Off |
Mac computer adminstrators may refresh content or disable management | Off |
All other settings | Defaults |
Example 3: Shared lab or front-desk Macs
For Macs several people use.
Setting | Value |
Login window prompt configuration | Off (user list) |
Display administrator users at login window | Off |
Show additional information in the menu bar | HostName |
Hide the Shut Down button | On |
Hide the restart button | On |
Disable the Shut Down menu item while logged in | On |
Disable the Restart menu item while logged in | On |
Reopen windows when logging back in | Off |
Guest account | Off |
Mac computer adminstrators may refresh content or disable management | Off |
Users pick their account from the list, and the host name identifies the Mac. Admin accounts stay hidden, and users can't shut down or restart from the menus.
Verify the policy
On the Mac:
Open System Settings > General > Device Management (on older macOS, System Preferences > Profiles). Open the Swif profile and confirm that it includes Login Window settings.
Or run this in Terminal and look for the
com.apple.loginwindowpayload:sudo profiles show -type configuration
Log out, or restart for FileVault behavior, and check:
the prompt type (user list or name and password)
that the banner appears
which users are listed
that the hidden buttons are gone
If you turned off the Guest account, confirm that Guest User isn't listed and that Users & Groups in System Settings shows it as off.
In Swif, open the device and confirm that the policy shows as applied.
Troubleshooting
Users see the old login window after the policy applies
Login window changes show up at the next logout or restart. Log out or restart to check.
The FileVault unlock screen looks different from the login window
FileVault's unlock screen appears before macOS starts and doesn't follow every login window setting. See FileVault's Effect on the macOS Login Window.
The Platform SSO sign-in doesn't appear after startup
Turn on Disable automatic login if FileVault is enabled. Without it, unlocking FileVault logs the user straight in.
A user can't log in after the policy applies
Local standard (non-admin) users may log in may be off. Turn it on, or have an administrator log in.
The administrator account isn't in the user list
Display administrator users at login window is off. Turn on Login to other user sessions so users can choose Other… and type the name, or turn on Login window prompt configuration.
Users can still shut down the Mac
The power options hide buttons and menu items only. They don't disable the power button.
Local admins can bypass managed settings
Turn off Mac computer adminstrators may refresh content or disable management.
Related resources
Swif
Apple