The macOS System Settings application provides a simplified view of the user accounts installed on your computer. However, it completely hides the dozens of system-level and service accounts that operate in the background. When auditing a Mac for security purposes or writing administrative bash scripts, you need a way to view and interact with the raw directory data. For this, Apple provides the highly powerful Directory Service command line utility, known as dscl.
Understanding Directory Services
Unlike Linux systems which typically rely on the flat /etc/passwd file to store user information, macOS utilizes a complex database called Directory Services (OpenDirectory). The dscl command acts as a direct interface into this database, allowing you to read, create, delete, and modify directory nodes (such as users and groups) without a graphical interface.
Listing All Local Users
The most common use case for dscl is generating a complete list of every single user account registered on the local machine, including hidden system daemons.
- Open the Terminal application.
- To list all user accounts on the local node, type the following command:
dscl . -list /Users
- Press Enter.
The terminal will output a massive, alphabetised list. You will see your standard login names (e.g., “johndoe”), but the list will be dominated by accounts beginning with an underscore (e.g., _amavisd, _appleevents, _windowserver). These are the hidden system accounts that macOS uses to sandbox background processes securely.
Filtering Out Hidden System Accounts
While seeing system accounts is useful for deep auditing, it is usually overwhelming if you simply want a list of human beings who can log into the computer. Because Apple convention dictates that hidden system accounts begin with an underscore, you can pipe the dscl output into the grep command to filter them out instantly.
dscl . -list /Users | grep -v '^_ '
(Note: Depending on your macOS version, there might be a trailing space after the username, so using grep -v '^_' is the safest approach to exclude any line starting with an underscore).
This filtered command will output a clean, concise list containing only the actual, interactive user accounts on the Mac.
Reading Specific User Attributes
The dscl utility does not just list names; it can read the specific attributes tied to an account, such as their home directory path, their User ID (UID), or their default shell.
To read the full directory record for a specific user, use the -read flag followed by the username. For example, to view the data for a user named “admin”:
dscl . -read /Users/admin
If you only want to know the user’s specific home directory path without seeing the rest of the database noise, you can append the attribute name to the end of the command:
dscl . -read /Users/admin NFSHomeDirectory
The terminal will output exactly where that user’s files are stored on the hard drive, making dscl an invaluable tool for automated administrative scripts.