"Guest account disabled (macOS)" policy checks wrong domain

[WilliamDEdwards]

• @noahtalerman: looks like this is a built-in policy in the UI.
  • We're getting rid of these in the UI but is it on the website too? If yes, I think we should fix it there.
  • UPDATE: @noahtalerman: Yes, it's on the website here and it's fixed 🎉

---

Even though our profile disabled the guest account (DisableGuestAccount = false), Fleet's built-in "Guest account disabled (macOS)" policy was failing.

The query:

SELECT 1 FROM managed_policies WHERE domain='com.apple.loginwindow' AND name='DisableGuestAccount' AND value='1' LIMIT 1;

... is incorrect. The correct domain is com.apple.MCX (source: https://developer.apple.com/documentation/devicemanagement/accounts#discussion).

Fleet version: 4.59.1

[jmwatts]

Fleet version: v4.59.1

Web browser and operating system: N/A

---

💥  Actual behavior

Policy fails

🧑‍💻  Steps to reproduce

1. Create a MacOS configuration profile to disable guest account, deploy to MDM enabled host and verify it has been installed
2. Create a policy to check for "Guest account disabled" - one of the Fleet pre-built policies
3. Refetch host vitals from the host's My device page

🕯️ More info (optional)

Tested on MacOS 15.x, 14.x, and 13.x
Updating the policy to run:

SELECT 1 FROM managed_policies WHERE domain='com.apple.MCX' AND name='DisableGuestAccount' AND value='1' LIMIT 1;

succeeds.