Managing macOS user accounts, group memberships, and administrative privileges can be accomplished via System Settings, but enterprise fleet managers, DevOps engineers, and MDM administrators require programmatic automation. The built-in dscl (Directory Service Command Line) utility communicates directly with Open Directory (the macOS local directory service daemon), allowing complete user account lifecycle provisioning directly from Terminal or remote management scripts.
Understanding the Local Open Directory Node
Unlike Linux distributions that store user definitions in flat text files like /etc/passwd and /etc/group, macOS maintains user records within the local directory hierarchy accessible at the . (local node) path under /Local/Default.
# List all local user accounts registered on macOS
dscl . -list /Users
# Filter out system service accounts (IDs under 500)
dscl . -list /Users UniqueID | awk '$2 >= 500 {print $1, $2}'| dscl Subcommand | Functional Behavior | Usage Example |
|---|---|---|
-read |
Outputs attributes and values for a user or group node. | dscl . -read /Users/john |
-create |
Instantiates a new directory node or populates an attribute. | sudo dscl . -create /Users/testuser |
-append |
Adds an item to an existing array attribute (e.g., group membership). | sudo dscl . -append /Groups/admin GroupMembership user |
-delete |
Removes an attribute or permanently deletes an entire user record. | sudo dscl . -delete /Users/testuser |
-passwd |
Changes or updates the account password. | sudo dscl . -passwd /Users/john newpass |
Creating a Standard Local User Account Programmatically
Provisioning a complete local user account via dscl requires defining five mandatory directory attributes: RealName, UniqueID, PrimaryGroupID, UserShell, and NFSHomeDirectory.
# 1. Create the user node
sudo dscl . -create /Users/developer
# 2. Assign the full display name
sudo dscl . -create /Users/developer RealName "Dev Administrator"
# 3. Assign a unique User ID (UID 501+)
sudo dscl . -create /Users/developer UniqueID 505
# 4. Set the Primary Group ID (20 corresponds to 'staff')
sudo dscl . -create /Users/developer PrimaryGroupID 20
# 5. Define the default shell environment
sudo dscl . -create /Users/developer UserShell /bin/zsh
# 6. Specify the user home directory path
sudo dscl . -create /Users/developer NFSHomeDirectory /Users/developer
# 7. Set the account password securely
sudo dscl . -passwd /Users/developer "ComplexTempPassword123!"Provisioning the Home Directory and Permissions
Creating the directory service entry establishes the account record, but macOS requires generating the physical directory structure under /Users/developer:
# Create user folder using standard skeleton template
sudo createhomedir -c -u developer
# Ensure proper user and group ownership
sudo chown -R developer:staff /Users/developerGranting and Revoking Administrator Privileges
To promote a standard user account to an administrative user with sudo capabilities, append their username to the local admin group:
# Grant administrator privileges
sudo dscl . -append /Groups/admin GroupMembership developer
# Verify active group membership
dscl . -read /Groups/admin GroupMembership
# Revoke administrator privileges (demote back to standard)
sudo dscl . -delete /Groups/admin GroupMembership developerAutomating account provisioning via dscl allows IT professionals to standardize macOS deployment workflows, configure secure service accounts, and manage local directory nodes without manual GUI interaction.