Information
The guest account allows users access to the system without having to create an account or password. Guest users are unable to make setting changes and cannot remotely login to the system. All files, caches, and passwords created by the guest user are deleted upon logging out.
Rationale:
Disabling the guest account mitigates the risk of an untrusted user doing basic reconnaissance and possibly using privilege escalation attacks to take control of the system.
Impact:
A guest user can use that access to find out additional information about the system and might be able to use privilege escalation vulnerabilities to establish greater access.
Solution
Graphical Method:
Perform the following steps to disable guest account availability:
Open System Settings
Select Users & Groups
Select the i next to the Guest User
Set Allow guests to log in to this computer to disabled
Terminal Method:
Run the following command to disable the guest account:
$ /usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool false
Profile Method:
Create or edit a configuration profile with the following information:
The PayloadType string is com.apple.MCX
The key to include is DisableGuestAccount
The key must be set to <true/>
Additional Information:
By default, the guest account is enabled for access to sharing services but is not allowed to log into the computer.
The guest account does not need a password when it is enabled to log into the computer.