36

I would like to be able to create new users in Mac OS X 10.11 remotely after ssh'ing into the machine. On Mountain Lion, these steps were listed.

Running

dscl . -create /Users/joeadmin
dscl . -create /Users/joeadmin UserShell /bin/bash
dscl . -create /Users/joeadmin RealName "Joe Admin" 
dscl . -create /Users/joeadmin UniqueID "510"
dscl . -create /Users/joeadmin PrimaryGroupID 20
dscl . -create /Users/joeadmin NFSHomeDirectory /Users/joeadmin
dscl . -passwd /Users/joeadmin password 

dscl . -append /Groups/admin GroupMembership joeadmin

After the above, the user doesn't become admin. What next?

Community
  • 1
lobirkeland
  • 577
  • 1
    Also relevant are http://apple.stackexchange.com/questions/4814/ and http://apple.stackexchange.com/questions/112857/ and https://github.com/MagerValp/CreateUserPkg – bmike Feb 03 '16 at 14:52

4 Answers4

20

If you are here and your system is running anything from 10.10 and newer, the sysadminctl command is your best friend. It does a lot of magic that DSCL can't do.

Here's the output for sysadminctl:

sysadminctl[21233:29122637] Usage: sysadminctl
    -deleteUser <user name> [-secure || -keepHome]
    -newPassword <new password> -oldPassword <old password> [-passwordHint <password hint>]
    -resetPasswordFor <local user name> -newPassword <new password> [-passwordHint <password hint>]
    -addUser <user name> [-fullName <full name>] [-UID <user ID>] [-password <user password>] [-hint <user hint>] [-home <full path to home>] [-admin] [-picture <full path to user image>]

Pass '-' instead of password in commands above to request prompt.

Then you'll want to do:

sudo createhomedir -c 2>&1 | grep -v "shell-init"

To add/remove users use dseditgroup:

sudo dseditgroup -o edit -a usernametoadd -t user admin
sudo dseditgroup -o edit -a usernametoadd -t user wheel
ub3rdud3
  • 301
  • 2
  • 2
  • the command sudo createhomedir -c 2>&1 | grep -v "shell-init" also creates a folder in /var/setup on a clean install – Burcardo Jan 07 '19 at 17:01
  • 1
    @Burcardo that's okay as long as the accounts work, and users can use passwd to change their own passwords. In fact none of my machines have had any issues with that folder being created. – ub3rdud3 Jan 08 '19 at 18:51
8

The documentation lacks one important step:

reboot

or 

sudo reboot

After the reboot the user enjoys visible admin rights in System Preferences -> Users and Groups.

But: even without rebooting the user is admin already - it's just not visible in the PrefPane. If you login as joeadmin immediately after creating the account (e.g. fast user switching) the admin role is visible from within his account.

klanomath
  • 66,391
  • 9
  • 130
  • 201
  • Nice answer. I was going to comment to the OP to ask what does the account is not admin look like to dig into how they were using the user or testing admin group membership. Depending on how they check, a log out might be all they need for their current user to read the new user as admin... – bmike Feb 03 '16 at 14:49
  • @klanomath so without a reboot we cant add a new user from command line? However, using gui we can add a new user without a system reboot. – Exploring Jun 05 '20 at 00:06
6

After much testing, i have made this script to create user accounts from terminal. 

LOCAL_ADMIN_FULLNAME="Joe Admin"     # The local admin user's full name
LOCAL_ADMIN_SHORTNAME="joeadmin"     # The local admin user's shortname
LOCAL_ADMIN_PASSWORD="password"      # The local admin user's password

# Create a local admin user account
sysadminctl -addUser $LOCAL_ADMIN_SHORTNAME -fullName "$LOCAL_ADMIN_FULLNAME" -password "$LOCAL_ADMIN_PASSWORD"  -admin
dscl . create /Users/$LOCAL_ADMIN_SHORTNAME IsHidden 1  # Hides the account (10.10 and above)
mv /Users/$LOCAL_ADMIN_SHORTNAME /var/$LOCAL_ADMIN_SHORTNAME # Moves the admin home folder to /var
dscl . -create /Users/$LOCAL_ADMIN_SHORTNAME NFSHomeDirectory /var/$LOCAL_ADMIN_SHORTNAME # Create new home dir attribute
dscl . -delete "/SharePoints/$LOCAL_ADMIN_FULLNAME's Public Folder" # Removes the public folder sharepoint for the local admin
lobirkeland
  • 577
  • 1
    you can get rid of the line

    mv /Users/$LOCAL_ADMIN_SHORTNAME /var/$LOCAL_ADMIN_SHORTNAME # Moves the admin home folder to /var

    with a flag in your sysadminctl command -home /var/$LOCAL_ADMIN_SHORTNAME

     – ub3rdud3 Dec 06 '17 at 22:20
1

PrimaryGroupID have to be set to 80 to create an administrator account.

dscl . -create /Users/joeadmin PrimaryGroupID 80

check out this thread for more info.

I've also wrote a script for this purpose. Here is the gist link

Igor Voltaic
  • 332
  • 1
    It's better to set admin accounts' to 20 (the staff group), and then add a secondary membership to admin with the dseditgroup command. There are some parts of macOS that assume all user accounts are members of staff, and without that membership, your admin account may not be able to do some things that even standard (non-admin) accounts can do. – Gordon Davisson Aug 30 '20 at 20:11