Problem overview
When a macOS endpoint is suspected of unauthorized access or is at risk of compromise, completely locking down the system becomes essential. This script swiftly handles that by logging out active users and disabling their local accounts, ensuring no one can re-enter without the proper credentials or unlocking procedure, all while retaining remote management through Level.
#!/bin/bash
# This resource is provided as a convenience for Level users. We cannot
# guarantee it will work in all environments. Please test before deploying
# to your production environment. We welcome contributions to our community
# library
# Level Library
# https://level.io/library/script-macos-lock-device
# Initialize script-scoped error flag
script_errors=false
log_out_users() {
echo "Logging out all active users..."
users_list=$(who | awk '{print $1}' | sort -u)
for user in $users_list; do
if [[ "$user" != "root" ]]; then
# Get the user session ID
user_id=$(id -u "$user" 2>/dev/null)
if [[ -n "$user_id" ]]; then
sudo launchctl bootout gui/"$user_id" &> /dev/null
if [[ $? -eq 0 ]]; then
echo "User $user has been forcefully logged out."
else
echo "ALERT: Failed to log out user $user via launchctl. Attempting kill method..."
sudo pkill -KILL -u "$user_id"
if [[ $? -eq 0 ]]; then
echo "User $user has been forcefully logged out via kill."
else
echo "ALERT: Failed to log out user $user using any method. (May be a system-protected process)"
script_errors=true
fi
fi
fi
fi
done
}
# Function to disable all local user accounts (INCLUDING ROOT)
disable_local_accounts() {
echo "Disabling all local user accounts (including root)..."
local_users=$(dscl . list /Users | grep -vE '^(Guest|nobody|_.*|daemon)$')
for user in $local_users; do
sudo pwpolicy -u "$user" disableuser &> /dev/null
if [[ $? -eq 0 ]]; then
echo "Local account $user has been locked."
else
echo "ALERT: Failed to lock local account $user."
script_errors=true
fi
done
}
# Execute actions
log_out_users
disable_local_accounts
if [[ "$script_errors" == true ]]; then
echo "ALERT: Errors occurred during execution. Exiting with code 1."
exit 1
else
echo "All users have been logged out and locked successfully."
exit 0
fiThis script forcefully logs out every active user session, including those running with root privileges, preventing further interaction at the local level. It then disables local user accounts, effectively halting any new logins. Despite this lockout, Level remains connected and capable of subsequent device management tasks, enabling you to maintain control while securing the endpoint against unauthorized use.
Use cases
- Emergency lock for misplaced or stolen devices
- Preventing unauthorized changes on critical endpoints
- Heightened security after suspicious user activity
- Temporary lockdown for maintenance or compliance audits
Recommendations
- Test in a non-production environment to ensure compatibility
- Manually run the script in Level to trigger this script on demand
- Alternatively, build an Automation in Level with a schedule trigger or tag trigger for lockdowns
- Monitor locked accounts to confirm legitimate users remain restricted
- Use the macOS Unlock Device Script or remove the Lock tag to restore access