Beyond the System Settings GUI
When you need to create a new user account, change a password, or assign administrator privileges on a Mac, you typically open the “Users & Groups” pane in System Settings. However, this graphical interface is merely a simplified frontend for macOS’s core directory service: OpenDirectory.
For system administrators managing fleets of Macs, clicking through a graphical interface for every user change is incredibly inefficient. Enter the Directory Service Command Line utility (dscl). This powerful terminal tool allows you to directly read, write, and manipulate the hidden OpenDirectory databases that control user accounts, groups, and permissions on macOS.
Understanding the dscl Syntax
The dscl command interacts with the directory structure as if it were a standard file system. You navigate through paths like /Local/Default/Users instead of standard hard drive paths.
Because you are modifying critical system configurations, almost all write operations require sudo.
The basic interactive mode can be launched by simply typing dscl . (the period represents the local machine), but it is generally faster to use single-line execution commands.
Common Administrative Tasks Using dscl
1. Listing All User Accounts
To see a complete list of every user account registered on the Mac (including hidden system accounts used by background services):
dscl . -list /UsersYou will see names like _www, _spotlight, and your actual human user accounts.
2. Viewing a User’s Configuration
To see all the metadata associated with a specific user (e.g., a user named “jappleseed”), you can read their directory record. This will show their User ID (UID), Group ID (GID), home directory path, and login shell.
dscl . -read /Users/jappleseed3. Changing a User’s Password
If a user forgets their password, an administrator can forcefully reset it via the command line without needing to boot into Recovery Mode (assuming you have admin rights). Use the passwd subcommand instead of standard create/append flags.
sudo dscl . -passwd /Users/jappleseed NewStrongPassword123!4. Granting Administrator Privileges
In macOS, administrator rights are determined by whether a user belongs to the admin group (Group ID 80). You can promote a standard user to an administrator by appending their username to the admin group record.
sudo dscl . -append /Groups/admin GroupMembership jappleseedTo verify the change, you can read the admin group and check the “GroupMembership” line:
dscl . -read /Groups/admin5. Creating a Hidden User Account
IT administrators often need a local admin account on deployed Macs for troubleshooting, but they do not want that account cluttering up the macOS login screen and confusing the end-user.
Accounts with a User ID (UID) below 500 are automatically hidden from the login screen by macOS.
To create a hidden user, you must manually build the directory record step-by-step. Let’s create an account called “hiddenadmin”.
# Create the user record
sudo dscl . -create /Users/hiddenadmin
# Set the real name (optional)
sudo dscl . -create /Users/hiddenadmin RealName "IT Admin"
# Set the password
sudo dscl . -passwd /Users/hiddenadmin SuperSecret123!
# Assign a UID below 500 (Ensure this ID is not already used by checking with dscl . -list /Users UniqueID)
sudo dscl . -create /Users/hiddenadmin UniqueID 401
# Assign to the primary group (usually 20 for 'staff')
sudo dscl . -create /Users/hiddenadmin PrimaryGroupID 20
# Add to the admin group for privileges
sudo dscl . -append /Groups/admin GroupMembership hiddenadmin
Conclusion
The dscl utility is the authoritative tool for user and group management in macOS. By mastering these commands, administrators can easily script the provisioning of new Macs, enforce hidden IT support accounts, and bypass the limitations of the graphical System Settings application.