Fleet version: v4.59.1

Web browser and operating system: N/A

💥  Actual behavior

Policy fails

🧑‍💻  Steps to reproduce

1. Create a MacOS configuration profile to disable automatic login and deploy to an MDM enabled host and verify it is installed
2. Create a policy to detect Automatic login disabled
3. Run the policy on the host

🕯️ Expected behavior

Policy passes and accurately reports whether or not the host has the profile installed, and thus whether or not the host has automatic login disabled.

🕯️ More info (optional)

Per our documentation, the managed_policies table contains the managed configuration policies from AD, MDM, MCX, etc.

This built-in policy will check to see if Automatic Login is Disabled via configuration policy (profile)
SELECT 1 FROM managed_policies WHERE domain = 'com.apple.loginwindow' AND name = 'com.apple.login.mcx.DisableAutoLoginClient' AND value = 1 LIMIT 1;

One of the first issues is that the profile created to disable automatic login claims to be able to do so regardless of FV status, but when I examined the contents of the profile, only the DisableFDEAutoLogin key is present.

Secondly, on a host that does not have FileVault enabled, that has already configured automatic login, the profile doesn't appear to actually enforce the disable automatic login feature, even after restarting the host.

Also worth noting that hosts with FileVault enabled can not configure automatic login regardless of whether or not the configuration profile is installed:

The existing built-in policy will fail regardless of Automatic Login disabled profile install status. If the policy is updated to:
SELECT 1 FROM managed_policies WHERE domain = 'com.apple.loginwindow' AND name = 'DisableFDEAutoLogin' AND value = 1 LIMIT 1;

It will pass for all hosts that have the profile installed. HOWEVER - for hosts that do not have FileVault enabled, the configuration profile doesn't actually disable automatic login, so it will be a false positive for "Automatic Login disabled"

Additionally the policy using DisableFDEAutoLogin ALWAYS passes for a host that does not have FileVault enabled, regardless of whether or not the configuration profile is installed.

The Policy with the updated query SELECT 1 FROM managed_policies WHERE domain = 'com.apple.loginwindow' AND name = 'DisableFDEAutoLogin' AND value = 1 LIMIT 1; accurately reports automatic login disabled profile installed status for FileVault enabled hosts, but not hosts that do not have FileVault enabled.

The only thing that seems to accurately report the setting on the host is running sysadminctl -autologin status in terminal.

Per @jmwatts's comment above, there doesn't seem to be a straightforward fix for this policy.

@mike-j-thomas @eashaw passing this to you to decide whether to remove it or update it, since policy templates will all live on the website in the future.