apple_device-management/mdm/profiles/com.apple.loginwindow.yaml

title: Login Window
description: The payload that configures Login Window behavior.
payload:
  payloadtype: com.apple.loginwindow
  supportedOS:
    iOS:
      introduced: n/a
    macOS:
      introduced: '10.7'
      multiple: true
      devicechannel: true
      userchannel: false
      requiresdep: false
      userapprovedmdm: false
      allowmanualinstall: true
      userenrollment:
        mode: forbidden
    tvOS:
      introduced: n/a
    visionOS:
      introduced: n/a
    watchOS:
      introduced: n/a
  content: The com.apple.loginwindow payload creates managed preferences on macOS
    for system/device profiles.
payloadkeys:
- key: SHOWFULLNAME
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system shows the name and password dialog. If `false`, the
    system displays a list of users.
- key: HideLocalUsers
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system shows only network and system users when showing
    a user list.
- key: IncludeNetworkUser
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system shows network users when showing a user list.
- key: HideAdminUsers
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system hides administrator users when showing a user list.
- key: SHOWOTHERUSERS_MANAGED
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system displays "Other..." when it shows a list of users.
- key: AdminHostInfo
  type: <string>
  presence: optional
  rangelist:
  - HostName
  - SystemVersion
  - IPAddress
  content: The admin host info. If present in the payload, the system displays its
    value in the Login Window as additional computer information. Before macOS 10.10,
    this string could only contain host name, system version, or IP address. After
    macOS 10.10, setting this key to any value allows the user to click the time area
    of the menu bar to toggle through various computer information values.
- key: AdminMayDisableMCX
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, a local administrator user can bypass or disable managed preferences
    (MCX settings) for their login session. The device presents the user with this
    option at login only when the user is a local administrator, and other users are
    not logged in.
- key: AllowList
  type: <array>
  presence: optional
  content: The list of user GUIDs or group GUIDs of users that the system allows to
    log in. An asterisk (`*`) string specifies all users or groups. This only applies
    to network accounts and mobile accounts.
  subkeys:
  - key: AllowListItem
    type: <string>
    presence: required
    content: A user or group GUID.
- key: DenyList
  type: <array>
  presence: optional
  content: The list of user GUIDs or group GUIDs of users that the system disallows
    to log in. This list takes priority over the list in the `AllowList` key. This
    only applies to network accounts and mobile accounts.
  subkeys:
  - key: DenyListItem
    type: <string>
    presence: required
    content: A user or group GUID.
- key: HideMobileAccounts
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system hides mobile account users in a user list. In some
    cases, mobile users show up as network users.
- key: ShutDownDisabled
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system disables the Shut Down button.
- key: RestartDisabled
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system disables the Restart item.
- key: RetriesUntilHint
  type: <integer>
  presence: optional
  default: 0
  content: If specified, allows a certain number of retries until the device shows
    a password hint. The device shows no hints if set to a value of 0.
- key: SleepDisabled
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system disables the Sleep button.
- key: DisableConsoleAccess
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system disregards the `>console` special user name, which
    provides a command line UI.
- key: LoginwindowText
  type: <string>
  presence: optional
  content: The text to display in the Login Window.
- key: ShutDownDisabledWhileLoggedIn
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system disables the Shut Down menu item when the user is
    logged in.
- key: RestartDisabledWhileLoggedIn
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system disables the Restart menu item when the user is logged
    in.
- key: PowerOffDisabledWhileLoggedIn
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system disables the Power Off menu item when the user is
    logged in.
- key: LogOutDisabledWhileLoggedIn
  supportedOS:
    macOS:
      introduced: '10.13'
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system disables the Log Out menu item when the user is logged
    in.
- key: DisableScreenLockImmediate
  supportedOS:
    macOS:
      introduced: '10.13'
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system disables the immediate Screen Lock functions.
- key: showInputMenu
  supportedOS:
    macOS:
      introduced: '10.8'
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system shows the Input Menu in the Login Window.
- key: DisableFDEAutoLogin
  supportedOS:
    macOS:
      introduced: '10.9'
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system disables the automatic login option when using FileVault.
- key: AutologinUsername
  supportedOS:
    macOS:
      introduced: '14.0'
      allowmanualinstall: false
  type: <string>
  presence: optional
  content: The user short name for an existing user to set up auto login.
- key: AutologinPassword
  supportedOS:
    macOS:
      introduced: '14.0'
      allowmanualinstall: false
  type: <string>
  presence: optional
  content: An optional user password to set up auto login. This must match the `AutologinUsername`
    user's current password.
- key: ForceWifiConfigurationOnLockScreen
  title: Enable WiFi network selection for login and unlock
  supportedOS:
    macOS:
      introduced: '27.0'
      allowmanualinstall: false
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system allows the user to select WiFi networks at login
    or unlock.
- key: ForceCaptivePortalConnectionFromLockScreen
  title: Enable captive WiFi portal for login and unlock
  supportedOS:
    macOS:
      introduced: '27.0'
      allowmanualinstall: false
  type: <boolean>
  presence: optional
  default: false
  content: If `true`, the system allows use of the captive WiFi portal at login or
    unlock.
examples:
- title: Profile example
  files:
  - file: examples/mdm/profiles/com.apple.loginwindow/example1.plist