The Deprecation of dscl
For decades, UNIX systems administrators managed local user accounts on macOS using the dscl (Directory Service command line) utility. If you needed to create a local administrator account during a fleet deployment, you would write a complex bash script using dscl to manually generate a User ID (UID), create a home folder, append the user to the local admin group, and inject a salted password hash.
With the introduction of modern macOS security architectures (specifically the Secure Enclave and cryptographic volume ownership), manually hacking user accounts together using dscl is highly dangerous. Bypassing Apple’s official account creation frameworks can result in users who cannot unlock FileVault, users who lack SecureToken privileges, or users whose home directories have shattered ACLs (Access Control Lists).
To mathematically and safely orchestrate local user lifecycle management from the command line, Apple introduced the sysadminctl utility. sysadminctl is a highly privileged wrapper that interacts directly with the OpenDirectory daemon and the modern macOS security subsystems. It guarantees that when you script the creation or deletion of a user, all necessary cryptographic tokens, home folder templates, and group memberships are generated flawlessly, exactly as if you had used the graphical System Settings application.
Step 1: Exploring the Capabilities
sysadminctl is designed for surgical account operations. Because it modifies the core local directory, every command requires sudo (root) privileges.
To view the acceptable parameters, execute the utility without arguments:
sysadminctlYou will see a concise list of flags allowing you to -addUser, -deleteUser, -secureTokenStatus, and -resetPasswordFor. Unlike dscl, which requires deep knowledge of XML plists and UNIX group IDs, sysadminctl accepts plain English arguments.
Step 2: Creating a Local Administrator Account
Suppose you are deploying a MacBook to a new employee. You use a Mobile Device Management (MDM) platform like Kandji to push a bash script. The script needs to create a hidden “IT Admin” backdoor account for emergency troubleshooting.
To create a local administrator named itadmin with the password SuperSecret123!, you execute a single, elegant command:
sudo sysadminctl -addUser itadmin -fullName "IT Administrator" -password "SuperSecret123!" -adminDecoding the Logic:
-addUser itadmin: The shortname (username) used for SSH or terminal logins.-fullName: The human-readable string displayed on the Mac login screen.-password: The plaintext password (whichsysadminctlwill instantly hash and salt securely).-admin: This critical flag autonomously adds the user to theadmin(Group ID 80) group, granting themsudoprivileges and the ability to unlock system preference panes.
The exact millisecond you run this command, the OpenDirectory daemon builds the user, generates a pristine home folder at /Users/itadmin based on the default Apple template, and assigns perfect UNIX ownership rights.
Step 3: The SecureToken Dilemma
Modern Macs utilize FileVault to encrypt the entire hard drive. However, not all users are allowed to decrypt the drive when the machine boots up. Only users possessing a cryptographic SecureToken can unlock the FileVault pre-boot screen.
If you create a user using the old dscl method, they will never receive a SecureToken. sysadminctl attempts to grant a SecureToken automatically, but it requires authorization.
If you are scripting the creation of a new user, and you want that new user to be able to unlock FileVault, you must pass the credentials of an existing administrator (who already has a SecureToken) to authorize the transaction.
sudo sysadminctl -adminUser existing_admin -adminPassword existing_password -addUser new_employee -fullName "New Hire" -password "TempPass123"To verify if the new user successfully received the cryptographic token required for FileVault, interrogate their status:
sysadminctl -secureTokenStatus new_employeeThe output must read: Secure token is ENABLED for user new_employee. If it says disabled, the user will be completely locked out of the machine upon the next reboot.
Step 4: Surgically Deleting User Accounts
When an employee is terminated, you must destroy their access to the machine. You can forcefully delete the user account using the -deleteUser flag.
However, you have a massive architectural decision to make regarding their residual data (the 50GB of files sitting in their /Users/jdoe folder).
Option A: Nuke the data permanently.
If you want to obliterate the user and securely erase their home folder from the SSD, use the -secure flag:
sudo sysadminctl -deleteUser jdoe -secureOption B: Preserve the data for Legal Hold.
If HR requires you to preserve the data for an investigation, but you still need to delete the login account, use the -keepHome flag:
sudo sysadminctl -deleteUser jdoe -keepHomeThe jdoe account vanishes from the login screen, but their home folder remains intact on the hard drive, allowing the IT department to harvest the files at a later date.
Step 5: Forcing Password Resets
If a user forgets their password, and you are connected to their Mac remotely via SSH (or pushing a script via Jamf), you can force a password change instantly without requiring the user’s old password.
sudo sysadminctl -resetPasswordFor jdoe -newPassword "NewTempPass99!"(Warning: While this resets the login password, it does NOT reset the user’s local Keychain password. The next time the user logs in with the new password, macOS will badger them for their old password to unlock their saved Safari passwords and certificates. If they cannot remember it, they will be forced to create a blank, fresh Keychain).
Conclusion
Manipulating local macOS user accounts using legacy UNIX directory utilities breaks the cryptographic chain of trust required by modern Apple Silicon and FileVault architectures. By transitioning to the sysadminctl utility, systems administrators ensure that automated account orchestration strictly adheres to Apple’s Secure Enclave requirements. The ability to programmatically deploy administrator accounts, safely manage SecureToken distribution, and securely obliterate terminated user data transforms macOS endpoint provisioning into a mathematically secure, enterprise-grade workflow.