0

I am working on a security setting for my company that requires users to not have a password hint. Since we have several users that either

  1. ignore our security options and
  2. purposely go against ones they don't like, I need a way to turn it off in terminal for 10.13-10.15.

I know I could create a script that pulls the User lists, and repopulates the opendirectory command to insert a 'blank' password (dscl . -merge /Users/username hint "password hint"), but I would like to turn off the ability as part of the setup. I have scoured the Internet and found nothing so far.

Does anyone have any suggestions?

PS. I also want to build a profile for it, but we are a ways away from profile management but any suggestions on that would be helpful as well.

2

The ability to disable Passwords Hints has been built into macOS

System Preferences → Users & Groups → Login Options. Just make sure "Show Password Hints" is unchecked.

enter image description here

Using Terminal, you can issue the command:

defaults write com.apple.loginwindow RetriesUntilHint -int 0

Your security policy

You aren't alone in dealing with employees/users who what to go against the grain so to speak when it comes to security. The users that you described: the ones who ignore your security and the ones who actively go against your policies can actually be the biggest threats to data security.

First thing to know is that there is no technology you can implement that will secure a user who ignores your security policy - i.e (don't use personal email accounts when sending sensitive documents) or employees that circumvent them (puts a Post-It note with their password on the screen because it needs to be changed every 90 days).

  • The very first thing you need to do is define the security policy and why it's being defined. Describe what data or system (or whatever) you are protecting and the risk it poses if it's compromised (i.e. loss of revenue, litigation, etc.).

  • The very next thing is to get buy in from management. Not only should you periodically remind employees, but have an official communication come from management spelling out the policy - don't do this alone!

  • Thirdly, involve HR (or whoever is ultimately responsible for hiring and firing) to spell out the consequences of not adhering to the policy.

Why is this important?

As an IT manager, I can't tell you the number of times a data breach occurred not because I or the systems I put in place failed, but people who didn't like the policies actively went around them. Having these operational policies in place squarely puts the burden on the employee and management and not you. Now, as an IT consultant (I charge for this type of analysis) I can't tell you how many times my business increased because the IT manager took my report, went back to management and said "see, I told you so."

Obviously, I'm speaking in broad terms, but the takeaway from this is to not shoulder security by yourself. Define your policy, use whatever tech is available (can afford) and get buy in from the whole organization.

| improve this answer | |
  • The GUI always overrides the writing of the default. I'm looking for a way to turn off the same setting in the GUI through the command line. If you know of any commands, I'm all ears. – Nick Papagorgio Jul 15 at 18:21
  • What do you mean "the GUI overrides the default?" That makes no sense. The default is what came from the factory and GUI is just the interface. The command line is the same as checking/unchecking the box. One more question - are your users admins? – Allan Jul 15 at 18:24
  • It doesn't make sense to me either. With it unchecked in the GUI, it doesn't offer a password hint. If I check it in the GUI is does. That's basic behaviour. But if I have it checked in the GUI, then run the command you posted, it does not deactivate the password hint. Ran as a user, sudo, or under su. It will still give a password hint. I have tested it under 10.13 and 10.15 and I get the same behaviour. I don't currently have a 10.14 box to test it on though. – Nick Papagorgio Jul 15 at 18:27
  • Are your users admins, though? Also...just thought about this...consider looking at the RSA SecureID Token. You could avoid this altogether and let them write whatever they want in the hint because this token changes every 60 seconds. Microsoft has an authenticator that works on phones or tablets. I use it on my iPhone for several services including Amazon and my Azure account. – Allan Jul 15 at 19:02
  • There are some users that could be admins, but I am trying to configure this out of the box with no third party tools. I know the functionality is there, I just want to know how to do it. – Nick Papagorgio Jul 15 at 20:00
0

If you are working on security then can I recommend that you use the Center for Internet Security benchmarks. They include tunring off password hints. Katie English at Jamf has developed a set of scripts that allows you to check the status of of the benchmarks on a machine and remediate anything broken. The CIS benchmarks also give you an easy way to discuss securing your Macs with your management or security team. You can find the security benchmarks on the CIS website.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .