The Shift Away from dscl
For over a decade, macOS system administrators relied on the dscl (Directory Service command line) utility to manage local user accounts, passwords, and group memberships from the Terminal. While dscl is exceptionally powerful, it interacts with macOS at a very low level. Using dscl to create a user account often requires executing half a dozen commands to manually stitch together the User ID, Group ID, home directory, password hash, and hidden attributes.
To streamline local user management, Apple introduced the sysadminctl utility in modern macOS releases. sysadminctl is a much safer, higher-level tool. It acts as a command-line wrapper for the same macOS APIs used by the “Users & Groups” graphical settings pane. By using sysadminctl, you guarantee that home directories are created correctly, SecureToken is managed properly for FileVault, and APFS permissions are set flawlessly.
Step 1: Creating a Standard User Account
Because creating a user account modifies the core system directory, sysadminctl must be run with root privileges (using sudo).
To create a standard user account (non-administrator) with a predefined password and full name, use the -addUser flag:
sudo sysadminctl -addUser jdoe -fullName "John Doe" -password "TempPass123!"In a single command, sysadminctl automatically assigns the next available UID (User ID), creates the home directory at /Users/jdoe, applies the correct ACL (Access Control List) permissions to the folders, and hashes the password into the shadow directory.
Note: If you do not want to expose the password in your terminal history, you can omit the -password flag, or pass -password - to be prompted securely.
Step 2: Creating an Administrator Account
Provisioning a local IT administrator account requires appending the -admin flag. This automatically adds the new user to the admin (Group 80) local group.
sudo sysadminctl -addUser itadmin -fullName "IT Administrator" -password "SecureAdmin99!" -adminThis is extremely useful when writing zero-touch deployment scripts (via an MDM like Jamf or Kandji) to silently provision a backdoor IT account upon enrollment.
Step 3: Resetting User Passwords
If a user forgets their local password and their Mac is not bound to a directory service (like Active Directory or Okta), you can reset the password directly via sysadminctl.
sudo sysadminctl -resetPasswordFor jdoe -newPassword "NewTemp456!"Important Warning: Resetting a password via the command line (or via a remote MDM command) breaks the synchronization with the user’s local “login keychain”. When the user logs in with the new password, macOS will prompt them to update their keychain password. If they cannot remember the old password, their previous keychain data (saved Safari passwords, secure notes) will be inaccessible, and a new keychain will be generated.
Step 4: SecureToken and FileVault Interactions
The biggest advantage of sysadminctl over dscl is its interaction with SecureToken. SecureToken is a cryptographic chain of trust required to unlock a FileVault-encrypted APFS volume.
When you create a new user via sysadminctl on an encrypted Mac, you must pass a SecureToken to the new user; otherwise, that user will not be able to log in at the FileVault boot screen.
To pass a SecureToken, you must authenticate the command with the credentials of an existing administrator who already holds a SecureToken.
sudo sysadminctl -addUser bsmith -fullName "Bob Smith" -password "Welcome1!" -adminUser itadmin -adminPassword "SecureAdmin99!"By supplying the -adminUser and -adminPassword flags, the system seamlessly grants Bob Smith a SecureToken during account creation.
Step 5: Deleting a User Account
Removing a user account is equally straightforward. However, you have two distinct choices regarding their data.
To delete the user and completely destroy their home folder and all data within it:
sudo sysadminctl -deleteUser jdoeTo delete the user but retain a compressed archive of their home folder (stored in /Users/Deleted Users/), you can append the secure flag (though standard deletion usually leaves a DMG image by default if configured graphically, sysadminctl requires explicit flags for retention depending on the macOS version. Check sysadminctl -h for the exact -secure syntax on your specific OS).
Conclusion
While dscl remains useful for reading deep directory attributes, sysadminctl is the definitive, Apple-supported method for modifying local user accounts on modern macOS. By utilizing its streamlined syntax, administrators can safely script account creation, password resets, and SecureToken handoffs without risking APFS corruption or keychain misalignment.