How to Audit User Group Membership and Access Control Lists in macOS Terminal Using dsmemberutil

In macOS system administration and enterprise directory integration, verifying whether a local or network user account possesses legitimate access to a file, folder, or administrative service is a frequent troubleshooting requirement. While standard Unix tools like groups or id inspect basic POSIX group assignments defined in /etc/group, macOS relies on Open Directory and modern Access Control Lists (ACLs). In these environments, user privileges are determined by a complex hierarchy of nested directory groups, Security Identifiers (SIDs), and Universally Unique Identifiers (UUIDs) that legacy command-line tools cannot resolve.

To provide accurate, definitive auditing of user permissions and group inheritance, Apple provides the dsmemberutil command-line utility. Operating directly against the macOS Directory Services subsystem and the kernel’s authorization framework, dsmemberutil allows administrators to test group membership, evaluate ACL permissions, and convert between user/group names and their corresponding GUIDs.

Understanding dsmemberutil Architecture

Unlike standard POSIX commands that only read static text files, dsmemberutil queries the running Open Directory daemon (opendirectoryd) and the macOS Access Control Engine. This provides several key diagnostic advantages:

• Nested Group Resolution: In Active Directory or Apple Open Directory environments, users frequently belong to groups that are nested inside other security groups. dsmemberutil resolves the complete inheritance chain to determine effective membership.
• ACL Permission Testing: It evaluates whether a user or group holds specific POSIX or granular extended ACL rights (such as read, write, execute, or delete) on protected directory nodes.
• UUID/GUID Mapping: Modern macOS access controls track identity via 128-bit GUIDs rather than legacy numeric UIDs/GIDs. dsmemberutil translates between human-readable names and internal directory identifiers seamlessly.

Checking Direct and Inherited Group Membership

The primary use case for dsmemberutil is testing whether a specific user belongs to a designated group. Use the checkmembership subcommand with the -u (user) and -g (group) switches:

dsmemberutil checkmembership -u johndoe -g admin

The command returns an unambiguous status message:

user is a member of the group

If the user does not belong to the target group, the terminal returns:

user is not a member of the group

Furthermore, dsmemberutil sets its process exit code to 0 on success (member) and 1 on failure (not a member), making it ideal for integration into bash or zsh provisioning scripts:

if dsmemberutil checkmembership -u "$USER" -g admin >/dev/null 2>&1; then
    echo "Administrative privileges verified."
else
    echo "Access denied: User lacks administrative group membership." >&2
    exit 1
fi

Checking User Membership Using GUIDs

When working with enterprise directory bindings where multiple user accounts share similar usernames across sub-domains, you can audit membership using raw Directory Services GUIDs:

dsmemberutil checkmembership -U FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000064 -G ABCDEF01-2345-6789-ABCD-EF0123456789

Converting Between User Names, UIDs, and GUIDs

macOS access control lists inspect GUIDs during authorization checks. To translate between traditional POSIX identifiers and Directory Service GUIDs, utilize the conversion subcommands:

1. Retrieve User GUID from Username

dsmemberutil getuuid -u johndoe

Output:

501E852D-0B92-4C9D-998C-D14B821A79B2

2. Retrieve Group GUID from Group Name

dsmemberutil getuuid -g admin

Output:

ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000050

3. Reverse Lookup: Identify Name from a GUID

When reviewing system logs or inspecting file ACLs with ls -le, you may encounter orphaned GUID strings. Convert the GUID back to a human-readable account name:

dsmemberutil getname -U 501E852D-0B92-4C9D-998C-D14B821A79B2

Auditing Access Control List (ACL) Permissions

In addition to group membership, dsmemberutil can simulate whether an identity has permission to perform specific actions on an ACL-managed resource using the checkaccess action:

dsmemberutil checkaccess -u johndoe -f /Users/Shared/ConfidentialProject read,write

The utility evaluates both standard Unix file mode bits and extended filesystem ACLs, reporting whether the requested operations are authorized.

Flushing the Directory Services Cache

If you have recently added a user to a group using dscl or through System Settings but dsmemberutil still reports that the user is not a member, the Directory Service lookup cache may be holding stale records. Flush the directory cache via dscacheutil:

sudo dscacheutil -flushcache

Re-running dsmemberutil checkmembership immediately reflects the updated group topology.

Utilizing dsmemberutil provides macOS administrators with a fast, reliable method to verify permissions and troubleshoot access control issues in enterprise environments.