The Hidden Groups of macOS
If you open the “Users & Groups” pane in macOS System Settings, you will see a simple list of standard users and administrators.
However, macOS is built on a UNIX foundation, which utilizes a massive, hidden architecture of specialized system groups to control permissions. There is a hidden group called _www that controls the Apache web server. There is a hidden group called _developer that controls who is allowed to compile code using Apple’s Developer Tools.
Because Apple hides these critical security groups from the graphical interface, IT Administrators must use the Terminal to audit and manipulate them. The native tool for this is the dseditgroup (Directory Service Edit Group) command.
1. Auditing an Existing Group
Before you add a user to a group, you must verify the group actually exists and see who is currently in it.
Let’s audit the highly privileged admin group (the group that grants users sudo privileges and the ability to install software).
dseditgroup -o read adminBreaking down the flags:
-o read: Tells the command that the “Operation” is to simply read the data, not modify it.
This will dump the entire Directory Services record for the group. Scroll down to the GroupMembership array, and you will see the exact short-names of every single user on the Mac who holds administrative privileges.
2. Adding a User to a Hidden Group
Suppose you are deploying MacBooks to a team of software engineers. By default, macOS restricts standard users from using Apple’s debugging tools (like Instruments or DTrace) unless they have full Administrator privileges.
However, granting developers full Admin rights is a massive security risk. Instead, you can surgically add their standard user account to the hidden _developer group.
sudo dseditgroup -o edit -a jsmith -t user _developerBreaking down the flags:
-o edit: We are modifying the group.-a jsmith(Add): The exact short-name of the user we want to add.-t user(Type): Clarifies that we are adding a User record (not nesting another group)._developer: The target group.
The engineer (jsmith) can now compile and debug code natively without being granted the dangerous ability to install system-wide software or change firewall settings.
3. Removing a User from a Group (Revoking Privileges)
If an employee transfers to a different department, you must immediately revoke their specialized access.
If jsmith moves from Engineering to HR, you can remove them from the _developer group by simply swapping the -a (Add) flag for the -d (Delete) flag.
sudo dseditgroup -o edit -d jsmith -t user _developerThe change is instantaneous. The user’s access to the debugging tools is immediately severed at the UNIX kernel level.
4. Creating a Brand New Custom Group
If you are setting up a shared Mac in a corporate environment (like a render farm or a local file server), you might want to create a custom group to manage folder permissions (e.g., a “VideoEditors” group).
sudo dseditgroup -o create -q VideoEditorsYou can then use the standard chown and chmod commands to assign massive external hard drives directly to the VideoEditors group, and use dseditgroup to continually add or remove freelancers from the group without ever touching the graphical interface.
Conclusion
The dseditgroup command is the definitive tool for managing macOS Role-Based Access Control (RBAC). By exposing the hidden UNIX group architecture, it allows IT administrators to provision incredibly precise security permissions via automated deployment scripts, completely bypassing the restrictive System Settings GUI.