How to Configure and Deploy a Custom Login Window Policy Banner in macOS via Terminal

In enterprise corporate environments, educational institutions, and government agencies, compliance standards (such as NIST, CIS Benchmarks, and ISO 27001) mandate that workstations present an explicit Acceptable Use Policy (AUP) or legal warning prior to granting user access. While basic lock-screen lock messages can be defined via macOS System Settings, they are restricted to short, unformatted text strings suitable only for asset identification or contact phone numbers. For formal compliance enforcement, Apple provides a native mechanism known as the Policy Banner. When configured, macOS halts the graphical login sequence, displaying a scrollable, formatted legal agreement that requires users to click an explicit Accept button before entering their account credentials. Understanding how to create, deploy, and troubleshoot policy banners using macOS Terminal enables system administrators to enforce institutional governance across Apple fleets.

Understanding Policy Banner Architectural Mechanics in macOS

The macOS login window daemon (loginwindow) checks for the existence of specific policy files during the pre-login graphical boot phase. Unlike third-party login hooks or launch agents that execute within an authenticated user context, the policy banner executes prior to user session creation at the system level.

The loginwindow process searches specifically for files located in the root library directory at /Library/Security/PolicyBanner.*. The file extension dictates the parsing engine and rendering styling employed by the operating system:

• PolicyBanner.txt: Plain ASCII or UTF-8 text file. Renders basic unformatted text across standard system fonts.
• PolicyBanner.rtf: Rich Text Format document. Permits custom typography, bold headings, bulleted lists, and colour formatting.
• PolicyBanner.rtfd: Rich Text Format with Attachments directory bundle. Allows organisations to embed corporate logos alongside formatted textual agreements.

If multiple banner files exist simultaneously in /Library/Security/, macOS prioritises PolicyBanner.rtfd over PolicyBanner.rtf, and PolicyBanner.rtf over PolicyBanner.txt.

Authoring a Compliant Policy Banner Document via Terminal

To establish a clean baseline legal agreement, you can author a formatted text banner directly from macOS Terminal.

1. Open Terminal from /Applications/Utilities/.
2. Ensure the parent security directory exists with correct administrative permissions:

   sudo mkdir -p /Library/Security

3. Create a new plain text policy banner using the nano editor:

   sudo nano /Library/Security/PolicyBanner.txt

4. Enter your organisation’s legally approved warning language. For example:

   UNAUTHORISED ACCESS PROHIBITED
   
   This computer system is the private property of Enterprise Organization Ltd. 
   Access is restricted strictly to authorised personnel for official business purposes.
   
   By clicking "Accept" and logging into this workstation, you acknowledge and consent to:
   - Continuous monitoring, logging, and auditing of all system activities.
   - Compliance with corporate data governance and security policies.
   - Immediate revocation of access privileges upon policy violation.
   
   If you are not an authorised user, disconnect immediately.

5. Save the file by pressing Ctrl + O, press Enter to confirm the filename, and exit nano by pressing Ctrl + X.

Authoring Rich Text (RTF) Banners with Custom Formatting

For executive presentation incorporating bold headings, indented lists, and branded typography, deploy an RTF formatted document.

1. Open TextEdit on macOS.
2. Press Cmd + Shift + T to ensure TextEdit is operating in Rich Text mode (not Plain Text).
3. Compose your legal notice, formatting headings with larger font sizes, bold weight, and corporate brand colours.
4. Click File > Save, name the file PolicyBanner.rtf, and save it to your desktop.
5. Return to Terminal and deploy the rich text file into the system security store:

   sudo cp ~/Desktop/PolicyBanner.rtf /Library/Security/PolicyBanner.rtf

Enforcing File Permissions and Access Control Lists (ACLs)

The single most common reason a policy banner fails to appear at the login screen is incorrect file ownership or restrictive permissions. The loginwindow process runs under the unprivileged _securityagent user context. If the policy banner file is not readable by everyone, the system skips banner rendering entirely.

1. Set file ownership to root and the wheel group:

   sudo chown root:wheel /Library/Security/PolicyBanner.*

2. Grant universal read permissions (read for owner, group, and all users; write for owner only):

   sudo chmod 644 /Library/Security/PolicyBanner.*

3. Remove any inherited quarantine flags or extended attributes attached to the file:

   sudo xattr -c /Library/Security/PolicyBanner.*

4. Verify the applied permissions by listing directory details:

   ls -laeO /Library/Security/PolicyBanner.*

   The output must confirm -rw-r--r-- 1 root wheel with zero quarantine attributes.

Testing and Validating Policy Banner Presentation

You do not need to reboot the entire Mac to test policy banner presentation. Testing can be initiated by logging out of your active graphical user session.

1. Click the Apple menu () in the top-left corner and select Log Out [Your Name]… (or press Cmd + Shift + Q).
2. Confirm the logout prompt.
3. As the login window initialises, macOS halts the credential input prompt and presents your custom policy banner within a centered modal dialogue window.
4. Observe the controls: users must scroll to review the agreement and explicitly click the Accept button. Clicking Accept displays the standard username and password fields.
5. If a user clicks Cancel, the login window re-locks and resets without authenticating the session.

Removing or Decommissioning Policy Banners

If workstation policy requirements change or a machine transitions out of high-security compliance mandates, decommissioning the banner requires removing the source file:

sudo rm -f /Library/Security/PolicyBanner.*

Once deleted, the macOS login window reverts immediately to the standard login screen on the next logout or restart cycle.