The Apple System Preferences Security Policy allows administrators to control and restrict key macOS system security settings.
By enforcing this policy, IT teams can prevent users from modifying critical security configurations such as password changes, lock screen messages, and firewall settings.
This policy is ideal for organizations that require strict control over device security, compliance posture, or standardized security settings across their macOS fleet.
Overview
macOS provides system preferences that allow users to modify security-related settings.
However, unmanaged access can lead to:
Weak or inconsistent password policies
Users overriding security messages or compliance banners
Incorrect firewall configurations that expose the device to risk
The Apple System Preferences Security Policy enables administrators to lock down these controls to maintain device integrity and prevent unauthorized changes.
Requirements
macOS 10.10+
Device must be enrolled in Swif.ai MDM
Some restrictions may require supervised or ADE-enrolled macOS devices
Configurable Settings
Below is a breakdown of the configurable options within this policy.
Disallow User to Change Password
Prevents users from changing their local account passwords.
Setting | Description | Minimum Requirement |
True | Users cannot modify their macOS account password. | macOS 10.10+ |
False | Users may change their password normally. | macOS 10.10+ |
Use Case:
Environments where passwords are managed by SSO, LDAP, or centralized authentication systems.
Disallow User to Set Lock Message
Blocks users from modifying the lock screen message displayed when the device is locked.
Setting | Description | Minimum Requirement |
True | Lock screen message cannot be changed. | macOS 10.10+ |
False | User may customize the lock message. | macOS 10.10+ |
Use Case:
Organizations that require a standardized asset ownership message or legal/compliance notice.
Don’t Allow Firewall UI
Prevents the user from changing the macOS firewall settings via the UI.
Setting | Description | Minimum Requirement |
True | Users cannot access or modify the firewall UI. | macOS 10.10+ |
False | User may adjust firewall settings freely. | macOS 10.10+ |
Use Case:
High-security environments where the firewall must remain centrally managed.
Best Practices
Pair this policy with Apple Firewall Policy to control both UI access and firewall behavior.
Use Disallow Password Change for devices integrated with Platform SSO, Okta, Azure AD, or Google SSO.
Enforce a standard lock screen message using the Apple Login Window Policy while disabling user modification via this policy.
Recommended for enterprise, healthcare, education, financial, and government environments requiring strict controls.
How to Configure
Navigate to Swif Admin Console → Policies → Create New Policy
Select Apple System Preferences Security Policy
Configure the settings:
Disallow Password Changes
Disallow Lock Message Changes
Disable Firewall UI
Click Continue
Assign the policy to devices or device groups
Save and apply the policy
Devices will enforce these restrictions automatically during the next MDM sync.
Compliance & Security Benefits
Ensures security configurations remain consistent and tamper-proof
Prevents users from weakening security by altering system settings
Helps enforce corporate or regulatory security standards
Reduces IT support overhead by removing user access to advanced settings
Strengthens endpoint security posture across the entire macOS fleet