Audit
Run compliance checks directly on your Mac and see results in real-time.
Instantly identify what's compliant, what's not, and what needs manual review.
What Does Audit Do?
Every rule in your baseline has a check command, a small script that verifies whether a specific setting is in compliance. Audit takes all of those checks and runs them against your Mac in one pass, telling you rule by rule what's compliant, what isn't, and what needs your attention.
Audit vs Build: What's the Difference?
Build generates files (scripts, profiles, DDM) that you deploy to other Macs via MDM.
Audit runs those same checks right now, on this Mac, and shows you the results immediately. It's how you verify compliance on a specific machine.
Audit Status Types
Each rule receives one of these statuses after checking:
The setting matches the expected value. This Mac is compliant for this rule.
The setting does not match the expected value. This Mac needs remediation.
The check couldn't run or returned unexpected output. Investigate manually.
No automated check exists. You must verify this rule manually and set the status yourself.
This rule doesn't apply to this system. Excluded from the pass rate calculation.
The rule hasn't been checked yet. Waiting for the audit to reach this rule.
The check is currently executing. You'll see this briefly as MACE works through each rule.
How Auditing Works
When you run an audit, MACE goes through each enabled rule and executes its check command:
Example: What Happens During a Check
For a rule like "Enable Firewall Logging":
/usr/libexec/ApplicationFirewall/socketfilterfw --getloggingmodeLog mode is onIf the output was "Log mode is off", the result would be Fail.
Privileged Helper
Some compliance checks need administrator access to read protected system settings. MACE includes a privileged helper tool that runs these checks securely.
Certain security settings can only be read with root privileges — for example, checking FileVault status or reading protected system preferences. The helper tool enables these checks without running the entire app as root.
On the first audit you run, macOS prompts you to approve the helper tool. This is a standard macOS security prompt for privileged tools. Once approved, the helper is available for all future audits and you won't be prompted again.
Safety First
The audit helper will not install or run without your permission. You choose how it's used: install it permanently, or do a one-time run where the helper is removed as soon as the audit finishes. MACE also shows a code execution warning each time you start an audit — review it and acknowledge before any checks run.
Because the helper runs your rules' check commands with admin privileges, make sure you trust the baseline you're using. If you've added custom rules or are using an unfamiliar baseline, review them first.
Running an Audit
Tip: Load Last Audit
With Save Last Audit enabled in Settings, MACE saves each completed run to the project. On your next audit, the code execution warning offers Load Last Audit — restore those results instantly instead of re-running every check.
Audit Engines
Choosing an engine is the first decision when you start an audit — the engine cards appear at the top of the audit sheet:
mSCP Audit Engine
Uses the original mSCP Python scripts. For organizations already using mSCP command-line tools.
- Standard mSCP audit output
- Python-based execution
- Full mSCP compatibility
M.A.C.E. Audit Engine
The recommended engine. Fast, full-featured, and built into MACE.
- Real-time results with Watch Live
- Export to PDF, HTML, spreadsheets, JSON, Markdown, and STIG checklists
- Override results and add comments
- Supports all customizations
Audit Options
After selecting the M.A.C.E. engine, its options appear below the engine cards:
Audit Mode
Runs each rule's check command against the live system and verifies the output against the expected value. Requires admin access via the privileged helper.
Compares locally deployed mobileconfig profiles against what each rule requires. Only works with rules that have mobileconfig_info defined — script-based rules are excluded.
Run Options
Shows results updating in real-time as each rule is checked. Pass/fail results appear immediately as the audit progresses.
When to disable: On slower Macs, live updates can slow down the audit. Turn it off to finish faster, then view all results at once.
Also audits rules you've excluded from the baseline. Useful for seeing where your Mac stands on the full rule set, even settings you've chosen not to enforce.
Only available when the baseline has excluded rules.
Understanding the Results
After the audit completes, you'll see:
Summary Statistics
The percentage of rules that passed. N/A and Manual Review rules don't count toward this number since they aren't automated checks.
Badges showing how many rules are in each status: Total, Passed, Failed, Manual Review, Errors, N/A.
Results Table
Each row shows one rule with its:
| 🏷️ | Status | Color-coded badge, e.g. Pass Fail |
| 🆔 | Rule ID | Unique identifier (or STIG ID for STIG compliance) |
| 📝 | Title | Human-readable rule name |
| 📂 | Section | Category the rule belongs to |
| 🎯 | Expected Output | What the check should return |
| 💻 | Actual Output | What was actually found |
| ⏱️ | Execution Time | How long the check took |
What You Can Do With Results
Filter by status (show only failures) or search by Rule ID, title, or section.
Manually change a rule's status if needed. Overrides are tracked and appear in exports.
Add notes to any rule explaining exceptions, compensating controls, or remediation plans.
Re-check a single rule without running the entire audit again.
Open a live Export Preview, then export in any of nine formats — from PDF and HTML to spreadsheets and DISA STIG checklists.
Manual Review Rules
Some rules don't have automated checks. These are marked Manual Review and require you to:
Why Some Rules Need Manual Review
Not every security setting can be checked automatically. Some require visual inspection (like checking a physical cable), reviewing policies, or judgment calls that can't be automated.
System Information Collection
MACE can collect device information to include in reports:
| 💻 | Serial Number | Your Mac's unique identifier |
| 📱 | Model Name | e.g., "MacBook Pro" or "Mac mini" |
| 🖥️ | Hostname | Your computer's network name |
| 🍎 | macOS Version | e.g., 15.0.1 |
This information is optional and can be included in exported reports to identify which Mac was audited.
What's Next?
| 📊 | Audit Results | Deep dive into working with results, overrides, and comments |
| 📄 | Exporting Reports | Live preview and export in nine formats, from PDF to DISA STIG checklists |