Login Window
com.apple.loginwindow
The payload that configures Login Window behavior.
Not available with User Enrollment · macOS: device channel only
Configuration Keys (39)
Showing 39 of 39 keys
| Key | Type | Description | Default | Range |
|---|---|---|---|---|
PFC_SegmentedControl_0stringrequired | string | — | Default: — | Range: — |
AdminHostInfostringShow additional information in the menu bar | string | The admin host info. If present in the payload, the system displays its value in the Login Window as additional computer information. Before macOS 10.10, this string could only contain host name, system version, or IP address. After macOS 10.10, setting this key to any value allows the user to click the time area of the menu bar to toggle through various computer information values. | Default: "HostName" | Range: HostName, SystemVersion, IPAddress |
LoginwindowTextstringBanner | string | The text to display in the Login Window. | Default: — | Range: — |
SHOWFULLNAMEbooleanDisplay login window as | boolean | If 'true', the system shows the name and password dialog. If 'false', the system displays a list of users. | Default: false | Range: — |
HideLocalUsersbooleanShow local users | boolean | If 'true', the system shows only network and system users when showing a user list. | Default: false | Range: — |
HideMobileAccountsbooleanShow mobile accounts | boolean | If 'true', the system hides mobile account users in a user list. In some cases, mobile users show up as network users. | Default: false | Range: — |
IncludeNetworkUserbooleanShow network users | boolean | If 'true', the system shows network users when showing a user list. | Default: false | Range: — |
HideAdminUsersbooleanShow Mac computer's administrator accounts | boolean | If 'true', the system hides administrator users when showing a user list. | Default: false | Range: — |
SHOWOTHERUSERS_MANAGEDbooleanShow "Other" | boolean | If 'true', the system displays "Other..." when it shows a list of users. | Default: false | Range: — |
SleepDisabledbooleanShow the Sleep button | boolean | If 'true', the system disables the Sleep button. | Default: false | Range: — |
RestartDisabledbooleanShow the Restart button | boolean | If 'true', the system disables the Restart item. | Default: false | Range: — |
ShutDownDisabledbooleanShow the Shut Down button | boolean | If 'true', the system disables the Shut Down button. | Default: false | Range: — |
RestartDisabledWhileLoggedInbooleanDisable the Restart menu item while logged in | boolean | If 'true', the system disables the Restart menu item when the user is logged in. | Default: false | Range: — |
Disable the Shut Down menu item while logged in | boolean | If 'true', the system disables the Shut Down menu item when the user is logged in. | Default: false | Range: — |
Disable the Power Off menu item while logged in | boolean | If 'true', the system disables the Power Off menu item when the user is logged in. | Default: false | Range: — |
| boolean | If 'true', the system disables the Log Out menu item when the user is logged in. | Default: false | Range: — | |
| boolean | If 'true', the system disables the immediate Screen Lock functions. | Default: false | Range: — | |
Disable automatic login if FileVault is disabled | boolean | A loginwindow password will be required to login. | Default: true | Range: — |
AutologinUsernamestringmacOS 14.0+ | string | The user short name for an existing user to set up auto login. | Default: — | Range: — |
AutologinPasswordstringmacOS 14.0+ | string | An optional user password to set up auto login. This must match the 'AutologinUsername' user's current password. | Default: — | Range: — |
| boolean | If 'true', the system disables the automatic login option when using FileVault. | Default: false | Range: — | |
DisableConsoleAccessbooleanEnable >console login | boolean | If 'true', the system disregards the '>console' special user name, which provides a command line UI. | Default: false | Range: — |
EnableExternalAccountsbooleanEnable external accounts | boolean | Allows external accounts to log in. | Default: true | Range: — |
AdminMayDisableMCXbooleanMac computer administrators may refresh content or disable management | boolean | If 'true', a local administrator user can bypass or disable managed preferences (MCX settings) for their login session. The device presents the user with this option at login only when the user is a local administrator, and other users are not logged in. | Default: false | Range: — |
TALLogoutSavesStatebooleanReopen windows when logging back in | boolean | Reopens windows that were open at time of logout | Default: true | Range: — |
Set Mac computer name to computer record name | boolean | Forces the name of the Mac to be set as the computer record name. | Default: true | Range: — |
AllowListarrayAllowed Users or Groups | array | The list of user GUIDs or group GUIDs of users that the system allows to log in. An asterisk ('*') string specifies all users or groups. This only applies to network accounts and mobile accounts. | Default: — | Range: — |
| string | A user or group GUID. | Default: — | Range: — | |
DenyListarrayDenied Users or Groups | array | The list of user GUIDs or group GUIDs of users that the system disallows to log in. This list takes priority over the list in the 'AllowList' key. This only applies to network accounts and mobile accounts. | Default: — | Range: — |
| string | A user or group GUID. | Default: — | Range: — | |
LocalUserLoginEnabledbooleanLocal-only users may log in | boolean | Permit only local users to log in. Network users won't be allowed to log in. | Default: — | Range: — |
LocalUsersHaveWorkgroupsbooleanLocal-only users use available workgroup settings | boolean | Local users are forced to use any available workgroup settings. | Default: — | Range: — |
FlattenUserWorkgroupsbooleanIgnore workgroup nesting | boolean | If users are part of a nested workgroup, only the settings of the user's workgroup are enforced. | Default: — | Range: — |
CombineUserWorkgroupsbooleanCombine available workgroup settings | boolean | If users are part of a nested workgroup, all nested workgroup settings are enforced. | Default: — | Range: — |
AlwaysShowWorkgroupDialogbooleanAlways show workgroup dialog during log in | boolean | If the workgroup has a specific dialog, that dialog is shown when users log in. | Default: — | Range: — |
ChangePasswordDisabledbooleanAllow user to change password | boolean | Enable or disable the "Change Password…" button in the Users & Groups preference pane. | Default: — | Range: — |
RetriesUntilHintintegerShow password hints after failed attempts | integer | If specified, allows a certain number of retries until the device shows a password hint. The device shows no hints if set to a value of 0. | Default: 0 | Range: — |
| boolean | If 'true', the system shows the Input Menu in the Login Window. | Default: false | Range: — | |
HiddenUsersListarrayHidden Users List | array | Hides users defined in the list from the login window under the Other button | Default: — | Range: — |
usernamestringUsername | string | — | Default: — | Range: — |
Enable WiFi network selection for login and unlock macOS 27.0+ | boolean | If 'true', the system allows the user to select WiFi networks at login or unlock. | Default: false | Range: — |
Enable captive WiFi portal for login and unlock macOS 27.0+ | boolean | If 'true', the system allows use of the captive WiFi portal at login or unlock. | Default: false | Range: — |