Adventures in Fast User Switching on macOS Monterey

For many years I have managed Fast User Switching (FUS) on macOS in the maner documented by Apple; with the MultipleSessionEnabled key in the .GlobalPreferences payload. Unfortunately as of Big Sur the documentation is no longer complete.

I didn’t notice until last week but Nathaniel Strauss reported this problem over a year ago in his article “Managing Fast User Switching Broken in Big Sur.” He also recently confirmed that he has had no luck in getting Apple to restore the functionality via that key.

However thanks to a push in the right direction from colleagues on the MacAdmins Slack, I now have control of FUS reliably working via configuration profile or defaults commands. Read on for the details…

Unbeknownst to me I had actually cracked the code a couple weeks ago when I went down the rabbit hole of documenting the configuration options for all the icons in the Menu Bar and Control Center. I’ll post a separate article on that soon.

Configuration Profile

MultipleSessionEnabled in .GlobalPreferences

As Strauss documented, when set alone, not only does this original key no longer work to enable FUS, but setting it to “true” with a configuration profile actually blocks the ability for users to enable the feature in the GUI. The exact opposite of how an admin would expect it to work.

In my testing it was not required to include this key at all when using a configuration profile to manage the two new keys I outline below, but I am including it in my .mobileconfig for completeness.

NOTE: macOS will write this key to disk when FUS is enabled via GUI or config profile. This value is not cleared when the configuration profile is removed. Leaving it behind does not seem to have any ill effect, but it could lead to confusion later.

There are two additional undocumented keys that need to be set to enable and configure Fast User Switching:

UserSwitcher in com.apple.controlcenter

This key is an integer with the following values that correspond to the Fast User Switching checkboxes in the Dock & Menu Bar preference pane:

8 = Hidden (FUS disabled)
2 = Show in Menu Bar
1 = Show in Control Center
3 = Show in both

This preference is what now controls whether FUS is enabled or not. Setting either of the three show options has the effect of enabling Fast User Switching.

userMenuExtraStyle in .GlobalPreferences

This key is an integer with the following values that correspond to the dropdown menu in the Login Options area of the Users & Groups preference pane:

0 = Full Name
1 = Account Name (username)
2 = Icon (default)

This preference controls how FUS is displayed in the Menu Bar and is only needed if you want to force the Full Name or Account Name options.

The above preferences can be enabled in a System level configuration profile and it will apply to all users on the computer. I have an example available on GitHub: FastUserSwitching.mobileconfig

Script

If a configuration profile is not an option for you, FUS can still be enabled and configured from the command line or with a script. The original key will need to be set with elevated privileges. However the new keys will need to be configured in the preferences of each individual user on a computer, not at the system level.

One option to accomplish this would be using Outset and a combination of a boot-once or boot-every script run by root and a login-once or login-every script that is executed in the user context.

If you use a different method and need to execute them all using a root agent make sure to adjust appropriately.

First, enable FUS using the original method:

sudo defaults write /Library/Preferences/.GlobalPreferences MultipleSessionEnabled -bool true

Next configure how the FUS menu is displayed as the user:

defaults write .GlobalPreferences userMenuExtraStyle -int 0

Finally enable FUS as the user using one of the integers from above:

defaults -currentHost write com.apple.controlcenter UserSwitcher -int 2

Default Behavior

Another thing to note is that the default behavior of FUS on macOS varies under different conditions. On an unmanaged system, FUS will be automatically enabled as soon as a second user is created. However when the users are created by MDM or another programatic method this does not happen and FUS remains off. Thanks to Mike Kingsley and Ari Leviatan for helping me figure out those default behaviors in March as part of the ProfileManifests project.