The Dangers of the Root User
In Unix-based operating systems like macOS, the root user (also known as the superuser) is an absolute, omnipotent account. Unlike a standard Administrator account—which still has to type a password to authorize changes and is blocked by System Integrity Protection (SIP) from deleting core operating system files—the root user has zero restrictions. It can read any file, modify any permission, and delete anything on the entire hard drive.
Because it is so dangerous, Apple completely disables the root user account by default on all Macs. Even if someone knows the root password, they cannot log into the account because it effectively does not exist.
However, system administrators performing deep-level data recovery, modifying low-level Unix daemon configurations, or troubleshooting severe permission corruption may occasionally need temporary access to this god-tier account. The dsenableroot (Directory Service Enable Root) command is the official Terminal utility to safely toggle this account on and off.
Step 1: Open the Terminal
Because you are altering the highest security level of the operating system, you must be logged into a standard Administrator account to run this command.
- Press Command + Space to open Spotlight Search.
- Type
Terminaland press Enter.
Step 2: Enabling the Root User
To awaken the root user account and assign it a password, run the following command:
dsenableroot
The Terminal will prompt you to authenticate your own identity first: “username:” and “password:” (Type your current Mac administrator password).
Once you verify that you have permission to make this change, the system will prompt you to create the new password for the root account: “root password:” and “verify root password:”
After typing it twice, the terminal will output: dsenableroot:: ***Successfully enabled root user.***
Step 3: Logging In as Root
Now that the root user is enabled, you can use it.
If you want to use it immediately inside the Terminal without restarting your Mac, simply type the “switch user” command:
su -
Type the new root password you just created. Your command prompt will change from a standard dollar sign ($) to a hashtag (#), visually indicating that you are now operating with absolute, unrestricted superuser power. (Type exit to leave root mode when you are finished).
Alternatively, if you want a graphical interface, you can log out of macOS entirely. At the Mac login screen, click “Other…”, type root as the username, and use your newly created password. You will log into a completely blank macOS desktop where Finder and all apps run with absolute privileges.
Step 4: Disabling the Root User (CRITICAL)
Crucial Warning: You must never leave the root user enabled on a Mac. Leaving it enabled is a massive security vulnerability. If a malicious script guesses the root password, it instantly gains total control of the hardware. The root account should only be enabled for the 10 minutes it takes you to fix your problem, and then immediately shut off.
To safely disable the root user and return the Mac to its secure default state, use the -d (disable) flag.
dsenableroot -d
The system will prompt you for your standard administrator password one last time. It will then output: dsenableroot:: ***Successfully disabled root user.***
The root account is now locked away, and the Mac is secure once again.