I haven't been able to find anything in /etc There's an /etc/openldap/ldap.conf but it's empty, even after I use the Directory Utility to create a bogus entry. Using find to look for any file modified within the past minute or two after using that utility also turns up nothing.

There's no such file as /Library/Preferences/loginwindow.plist There is no "loginwindow.plist" anywhere in /Library or /System/Library.

I'm really hoping for someone who KNOWS the answer. I can guess and poke around and experiment as much as anyone, but I can only spend so much time on trying to figure out the depthless mysteries of OS X :-P

---------- Post updated at 08:14 AM ---------- Previous update was at 08:04 AM ----------

Thanks, I'll look into those.

DISA STIGS

"The Security Technical Implementation Guides (STIGs) and the NSA Guides are the configuration standards for DOD IA and IA-enabled devices/systems."

The specific items I'm trying to check:

Check Content:
Open Finder.
Click the Hard Drive icon.
Double Click System.
Double Click Library.
Double Click CoreServices.
Double Click Directory Utility.
Click the Show Advanced Options button.
Click Services tab.
Click the Lock and enter the password to unlock the options (if needed).
Click the LDAPv3 service.
Click the Pencil icon.
Highlight the Server Name/Configuration Name.
Click Edit.
Click the Connection tab and verify "Encrypt using SSL" is selected. If "Encrypt using SSL" is not selected, this is a finding.
Click the Security tab and verify the "Use authentication when connecting" is checked. If option is not checked, this is a finding.
Click on Security tab and verify the "Disable clear text passwords" is checked. If the value is not checked, this is a finding.
Click on Security tab and verify the "Digitally sign all packets (requires Kerberos) " is checked. If the value is not checked, this is a finding.
Click on Security tab and verify the "Encrypt all packets (requires SSL or Kerberos) " is checked. If the value is not checked, this is a finding.
Click on Security tab and verify the "Block man-in-the-middle attacks (requires Kerberos)" is checked. If the value is not checked, this is a finding.

Since that's all server config issues, I doubt that directory queries would return them. Those settings have to be stored somewhere local... I just need to find out where. Dunno what's wrong with plaintext config files!