How to Use the macOS sysadminctl Command to Manage User Accounts

The Evolution of User Management

In older versions of macOS, system administrators created new user accounts from the Terminal using the complex dscl (Directory Service command line) tool. This required manually creating the user record, assigning a unique user ID, generating the home directory, and adding the user to specific permission groups one by one.

To streamline this process, Apple introduced the sysadminctl command. This powerful, high-level utility is designed specifically for managing local user accounts. It securely handles the creation, modification, and deletion of users, automatically handling all the underlying directory services and home folder generation in the background.

Step 1: Open the Terminal

Because you are interacting with core system security and user databases, you must run this tool with elevated privileges.

1. Press Command + Space to open Spotlight Search, type Terminal, and press Enter.
2. Prefix all sysadminctl commands with sudo.

Step 2: Creating a New User Account

To create a standard, non-administrative user account, you only need to specify the short name (the username used for logging in) and the full display name.

sudo sysadminctl -addUser jsmith -fullName "John Smith" -password "TempPassword123"

When you run this command, macOS will automatically calculate the next available User ID (UID), create the user record in the OpenDirectory database, and automatically generate a standard macOS Home folder (/Users/jsmith) populated with default folders like Desktop, Documents, and Downloads.

Step 3: Creating an Administrator Account

If you are deploying a Mac for a developer who needs the ability to install software and change system settings, you must grant them administrative privileges. You can do this at the exact moment of creation using the -admin flag.

sudo sysadminctl -addUser mroberts -fullName "Mary Roberts" -password "SecurePass456" -admin

The -admin flag automatically adds Mary to the admin (Group ID 80) permission group.

Step 4: Forcing a Password Reset

As a system administrator, you should never know your employees’ permanent passwords. When you create an account using a temporary password, you should force the user to change it the very first time they log in.

You can enforce this security policy using the -resetPasswordFor flag.

First, create the account:
sudo sysadminctl -addUser jdoe -fullName "Jane Doe" -password "Welcome2026"

Then, immediately force a reset:
sudo sysadminctl -resetPasswordFor jdoe -newPassword "Welcome2026" -passwordHint "Change immediately"

Wait, a better way to force a reset on next login without changing the password again is using the pwpolicy command, but sysadminctl handles password changes securely. If a user forgets their password, you can use sysadminctl -resetPasswordFor jdoe -newPassword "NewTempPass" to get them back into their account.

Step 5: Safely Deleting a User Account

When an employee leaves the company, you must revoke their access. You can use the -deleteUser flag.

sudo sysadminctl -deleteUser jsmith

Crucial Warning: By default, this command will delete the user’s login record and permanently delete their entire Home folder. If you need to keep their files for legal or archiving reasons, you must explicitly use the -keepHome flag.

sudo sysadminctl -deleteUser jsmith -keepHome

This will delete John’s ability to log into the Mac, but his /Users/jsmith folder will remain safely on the hard drive for the administrator to access.