Directory Services on macOS
macOS utilizes a core background service called Open Directory (managed by the opendirectoryd daemon) to handle user authentication, group memberships, and network domain lookups (like Active Directory bindings). To speed up these lookups, macOS aggressively caches this information in RAM.
However, if a system administrator updates a user’s permissions on the corporate Active Directory server, or changes an employee’s group membership, the Mac might refuse to acknowledge the change because it is stubbornly reading from its stale local cache. The user might be denied access to a network drive they clearly have permission to view.
To force the Mac to immediately abandon its cached data and query the domain controller fresh, you must flush the Open Directory cache via the Terminal.
Using the dscacheutil Command
The dscacheutil (Directory Service Cache Utility) command is the native tool for managing these backend databases. Because you are flushing system-wide authentication caches, you must execute the command with administrator privileges using sudo.
- Open the Terminal application.
- Execute the following command to completely wipe the Open Directory cache:
sudo dscacheutil -flushcache- Press Enter. You will be prompted for your Mac’s administrator password.
The command will execute silently. There is no confirmation message; the terminal will simply return you to a fresh prompt.
The Secondary Step: Restarting opendirectoryd
While flushing the cache is usually sufficient, in severe cases of network de-synchronization (such as a Mac completely losing its trust relationship with a Windows domain), the opendirectoryd daemon itself might be hung.
To guarantee a completely fresh start, you should forcefully restart the daemon immediately after flushing the cache.
Run the following command in the terminal:
sudo killall opendirectorydmacOS relies heavily on this daemon, so the system’s launchd process will instantly restart it within a fraction of a second. Once it restarts, it will reach out to your local Active Directory or LDAP server, pull down the newest user policies, and rebuild its cache from scratch, resolving your authentication issues.