How to disable that “Guest User” from appearing at the OS X 10.7.2 login screen
- Open System Preferences
- Click on “Security & Privacy”
- Click the lock in the lower corner and type in your administrative
password to unlock the control panel
- Check the box next to “Disable restarting to Safari when screen is
locked”
This prevents the Guest User account from being visible at the login screen both during reboot and at the login screen. Again, it’s highly recommended to keep this enabled for security purposes, but if your Mac is locked down with a security cable or you don’t have any use for Find My Mac, you could disable this and not feel too bad about it.
![enter image description here](https://i.stack.imgur.com/8szYD.jpg)
If you haven’t tried it yet, clicking on the Guest User account gives you this message:
This computer will restart to a secure, Safari-only system for the Guest user.
The reboot process is quick and opens directly to Safari, there is no access to anything else. No Finder, no preferences, nothing.
Source: osxdaily
Encrypt the startup volume with Core Storage without FileVault
Two days after I added this answer, Apple published a technical white paper: Best Practices for Deploying FileVault 2 – Deploying OS X Full Disk Encryption Technology (PDF). At a glance, some of what I describe below seems to be described by Apple as:
Preparation
- Backup
- start Recovery OS
- use Disk Utility to erase the startup volume – Mac OS Extended (Journaled, Encrypted)
- restore
- give the passphrase for the volume to AdminGuy.
Hint
At step 4 above, use a method that preserves the Apple_Boot slice (sometimes named Boot OS X, sometimes named Recovery HD) whilst restoring the JHFS+ startup volume.
To validate this answer, I used Disk Utility for that step. (I'm less familiar with restoration capabilities of Time Machine.)
The resulting EfiLoginUI:
![](https://i.stack.imgur.com/ZimoZ.jpg)
As Disk Password has an avatar/icon, it's clear that Apple considers scenarios such as this.
Normal use thereafter
- Alongside named users, EfiLoginUI presents Disk Password
- AdminGuy can select Disk Password
- AdminGuy can enter the passphrase to unlock the CoreStorage-protected startup volume
- when loginwindow appears, select the required user.
Users may change their login passwords. The phrase for Disk Password will remain unchanged.
You need not use the FileVault areas of System Preferences but if you do, most things work as expected.
The machine pictured above is perfectly clean, restored from a Mountain Lion template that I created following installation of the OS (at the Welcome screen I shut down, then used Disk Utility to image all partitions/slices of the disk). I proceeded to create a user, then enabled that user for FileVault:
![Screenshot: after clicking 'Done', all users are able to unlock the disk](https://i.stack.imgur.com/gCTjo.png)
The resulting EfiLoginUI – one named user alongside the Disk Password option:
![A named user and the Disk Password option at EfiLoginUI](https://i.stack.imgur.com/O12EX.jpg)
Appearance bug
System Preferences in Build 12A269 of OS X 10.8 may state that FileVault is enabled, with a recovery key set, when the key is no longer applicable. (Assume that an erased volume, with a possibly different passphrase, will not accept a recovery key that was set before erasure. A more definite opinion may be drawn from Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption (2012).) I have reported bugs to Apple.
Photographs above are of the USB flash drive that I used to validate this answer.
Photographs below are of the internal drive that I use every day.
EfiLoginUI – two named users enabled for FileVault, the Disk Password option, and the Guest User:
![my everyday EfiLoginUI](https://i.stack.imgur.com/fAkpg.jpg)
loginwindow – all named users:
![my everyday loginwindow](https://i.stack.imgur.com/8G2LI.jpg)
Best Answer
The one guest account with a proper picture is an OS account - you can remove it from the FileVault startup screen with this command.
Enter the following command in the Terminal:
That guest account is still around, but it’s not the one that comes from Find My Mac and FileVault - that’s the one with the shady silhouette - you can disable that by turning off Find My Mac or going to the user accounts preference pane in system preferences and electing the guest account configuration you prefer.