Some compliance requirements mandate disabling automatic execution of files downloaded from the internet. On macOS devices, this can be controlled through Safari and Google Chrome settings or enforced using MDM policies.
1. Disable AutoRun in Safari
By default, Safari includes a setting that allows it to automatically open files it considers “safe” (such as images, text documents, PDFs, and movies) after downloading.
Default Behavior (Without Policy Applied)
If checked: Safari automatically opens downloaded safe files.
If unchecked: Files are downloaded but not opened automatically.
You can test this by downloading a safe file (such as this .txt file).
With the box checked, the file opens automatically after download.
With the box unchecked, the file remains in the Downloads folder.
Enforced Behavior (With Policy Applied)
The Apple Safari Policy enforces the autoOpenSafeDownloads field.
The checkbox becomes greyed out, meaning users cannot change it.
Safari will no longer auto-open safe files after download.
2. Disable AutoRun in Google Chrome
In recent versions of Chrome, files are no longer automatically executed by default. However, Chrome still provides options for download handling and PDF behavior.
Default Behavior (Without Policy Applied)
Users can toggle whether Chrome asks for a download location each time.
Users can choose whether PDFs open directly in Chrome or are downloaded.
Enforced Behavior (With Policy Applied)
The Apple Google Chrome Policy enforces two fields:
Prompt For Download Location→ Always enabled. Chrome will ask where to save files before downloading, preventing auto-execution.Always Open Pdf Externally→ Enforced. PDF files are downloaded and must be opened in an external viewer, not in Chrome.
With these enforced:
Each download requires user confirmation of the save location.
PDFs never open automatically in Chrome—they are saved directly.
Compliance Evidence
Safari: Show the greyed-out checkbox indicating “Open safe files after downloading” is disabled and locked by policy.
Chrome: Show the enforced settings for Prompt for Download Location and Always Open PDFs Externally.
Both settings ensure that downloaded files are not executed automatically, meeting compliance requirements.
✅ With these policies applied via MDM, AutoRun is effectively disabled on macOS devices.