Category filter

Configuration profile to disable shutdown from macOS login

The login window on macOS typically displays a shutdown button that allows users to turn off the system from there. However, in certain situations, you might have to disable the shutdown from the macOS login window, such as shared workstations or public environments, to avoid accidental actions that might disrupt the devices’ functioning. Here’s a custom configuration profile that helps disable shutdown from the macOS login window. Hexnode’s Deploy Custom Configuration for Apple devices feature lets you remotely deploy custom configuration profiles across multiple endpoints.

Note:

This configuration profile is supported on devices running macOS 10.7 and above.

Disclaimer:

The sample configuration profiles provided below are created using various profile creator applications.

Here is a .plist file to disable shutdown from macOS login window:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadContent</key>
			<dict>
				<key>com.apple.loginwindow</key>
				<dict>
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<key>ShutDownDisabled</key>
								<true/>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
			<key>PayloadEnabled</key>
			<true/>
			<key>PayloadIdentifier</key>
			<string>MCXToProfile.bd86b41b-76ed-4db5-b130-6015d9f37396.alacarte.customsettings.fa5d2b44-8f46-4f6d-947d-3d1c3955b7b6</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<key>PayloadUUID</key>
			<string>fa5d2b44-8f46-4f6d-947d-3d1c3955b7b6</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
	</array>
	<key>PayloadDescription</key>
	<string>Included custom settings:com.apple.loginwindow</string>
	<key>PayloadDisplayName</key>
	<string>MCXToProfile: com.apple.loginwindow</string>
	<key>PayloadIdentifier</key>
	<string>ShutdownRemovedFromLoginwindow</string>
	<key>PayloadOrganization</key>
	<string></string>
	<key>PayloadRemovalDisallowed</key>
	<true/>
	<key>PayloadScope</key>
	<string>System</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>bd86b41b-76ed-4db5-b130-6015d9f37396</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
</dict>
</plist>

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>PayloadContent</key>

<array>

<dict>

<key>PayloadContent</key>

<dict>

<key>com.apple.loginwindow</key>

<dict>

<key>Forced</key>

<array>

<dict>

<key>mcx_preference_settings</key>

<dict>

<key>ShutDownDisabled</key>

<true/>

</dict>

</array>

</dict>

<key>PayloadEnabled</key>

<true/>

<key>PayloadIdentifier</key>

<string>MCXToProfile.bd86b41b-76ed-4db5-b130-6015d9f37396.alacarte.customsettings.fa5d2b44-8f46-4f6d-947d-3d1c3955b7b6</string>

<key>PayloadType</key>

<string>com.apple.ManagedClient.preferences</string>

<key>PayloadUUID</key>

<key>PayloadVersion</key>

</dict>

</array>

<key>PayloadDescription</key>

<string>Included custom settings:com.apple.loginwindow</string>

<key>PayloadDisplayName</key>

<string>MCXToProfile: com.apple.loginwindow</string>

<key>PayloadIdentifier</key>

<string>ShutdownRemovedFromLoginwindow</string>

<key>PayloadOrganization</key>

<key>PayloadRemovalDisallowed</key>

<true/>

<key>PayloadScope</key>

<string>System</string>

<key>PayloadType</key>

<string>Configuration</string>

<key>PayloadUUID</key>

<key>PayloadVersion</key>

</dict>

</plist>

What happens at the device end?

Usually, the device shows the Shut Down button in the login window.

However, deploying the configuration profile will conveniently disable shutdown from the macOS login window. It will prevent the user from accessing the Shut Down button from the login window.

Notes:

To create and customize configuration profiles, you can use tools like Apple Configurator, Profile Manager or manually create them using text editors.
Use non-encrypted .mobileconfig, .xml, or plist files to deploy profiles across devices.
Ensure that you do not associate conflicting configurations with the devices.
Use wildcards to fetch key values from the portal.
It is recommended to manually validate the configuration profile on a system before executing it in bulk.
Hexnode will not be responsible for any damage/loss to the system on the behavior of the configuration profile.

Need more help?

Raise a Ticket

Ask Community

Chat With us