Detections
Analytics

2.8.1 Audit Universal Control Settings

Information

Universal Control is an Apple feature that allows Mac users to control multiple other Macs and iPads with the same keyboard, mouse, and trackpad using the same Apple ID. The technology relies on already available iCloud services, particularly Handoff.

Universal Control simplifies the use of iCloud connectivity of multiple computers using the same Apple ID. This may simplify data transfer from organizationally-managed and personal devices. The use of the same iCloud account and Handoff is the underlying concern that should be evaluated. The use of the same keyboard or mouse across multiple devices does not by itself decrease organizational security.

Rationale:

The use of devices together when some are organizational and some are not may complicate device management standards.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Graphical Method:
Perform the following steps to set Universal Control to your organization's requirements:

Open System Preferences

Select Display

Select Advanced...

Set the options that meet your organization's requirements

Terminal Method:
Run the following command to enable or disable Universal Control:

$ /usr/bin/sudo -u <user> /usr/bin/defaults -currentHost read com.apple.universalcontrol Disable -bool <true/false>

$ /usr/bin/sudo -u <user> /usr/bin/defaults -currentHost read com.apple.universalcontrol DisableMagicEdges -bool <true/false>

example:

$ /usr/bin/sudo -u firstuser /usr/bin/defaults -currentHost read com.apple.universalcontrol Disable -bool true

$ /usr/bin/sudo -u firstuser /usr/bin/defaults -currentHost read com.apple.universalcontrol DisableMagicEdges -bool true


$ /usr/bin/sudo -u seconduser /usr/bin/defaults -currentHost read com.apple.universalcontrol Disable -bool false

$ /usr/bin/sudo -u seconduser /usr/bin/defaults -currentHost read com.apple.universalcontrol DisableMagicEdges -bool false

Profile Method:
Create or edit a configuration profile with the following information:

The PayloadType string is com.apple.universalcontrol

The key to include is Disable

Set the key to <true/> or <false/> based on your organization's requirements

Note: Since the profile method sets a system-wide setting and not a user-level one, the profile method is the preferred method. It is always better to set system-wide than per user.

Additional Information:

Universal Control: Use a single keyboard and mouse between Mac and iPad

Universal Control: Everything You Need to Know

See Also

https://workbench.cisecurity.org/benchmarks/14561

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|5.1, CSCv7|9.2

Plugin: Unix

Control ID: 4b51e3799552935d0d232eb57ae10a7b8907f96b1533ca122006e7cbec96d671