Vulnerability Discussion

TouchID enables the ability to unlock a macOS system with a user's
fingerprint.

TouchID must be disabled for "Unlocking your Mac" on all macOS devices that are capable of using
TouchID.

The system must remain locked until the user establishes access using an authorized identification and
authentication method.

Check

Verify the macOS system is configured to disable TouchID for unlocking the device with
the following command:

/usr/bin/osascript -l JavaScript << EOS
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.applicationaccess')\
.objectForKey('allowFingerprintForUnlock').js
EOS

If the result is not "false", this is a finding.

Fix

Configure the macOS system to disable TouchID for unlocking the device
by installing the "com.apple.applicationaccess" configuration profile.