Centrify - Securing the Cross Platform Data Center
Showing results for 
Search instead for 
Do you mean 

The Centrify Apple Guys

LMcAndrew

Creating a local Mac administrator account that is invisible

by on ‎03-23-2012 04:21 PM - last edited on ‎01-02-2014 11:13 AM by Centrify

***************************************************

Note:

The method for creating invisible accounts has since been updated to work across OS upgrades. Please see this article here for the new method:

 

http://community.centrify.com/t5/The-Centrify-Apple-Guys/How-to-create-a-Hidden-Local-Admin-account-...

 

***************************************************

 

Best practices for integrating with AD suggest that you keep a local administrator account on your Mac. It's possible to create this local administrator account and keep it hidden from users.

 

When you unbundle a new Mac, you'll need to create an admin account anyway. You use this to install Centrify and bind to Active Directory.

 

When you create a local admin account, give it the name ".admin" (with a period in front).

 

It won't show up in the list of users under System Preferences -> Users and Groups

 

Screen Shot 2012-03-23 at 4.02.03 PM.png

 

 

 

When the regular AD user logs in, it won't show up in the Users and Groups display.

 

 

 

 

Screen Shot 2012-03-23 at 4.11.34 PM.png

 

However, when you log in with the hidden admin account, it will show up in Users and Groups. 

 

Screen Shot 2012-03-23 at 4.15.58 PM.png

 

Thanks to Steven H for the tip.

 

 

Comments
by Centrify on ‎03-23-2012 04:54 PM

Pretty cool, but now I have to know where you've installed these hidden admin accounts. How can I see if the machine has a hidden admin account or not, is there a CLI command to show the account?

by Shaun Prince(anon) on ‎09-21-2012 09:05 AM

from a terminal, you should be able to use:

ls -al /Users

 

by Juno(anon) on ‎04-20-2013 02:39 AM

and how to unhidden??

by R0B(anon) on ‎06-03-2013 10:58 AM

I would like to know as well how to unhidden???

by Centrify on ‎06-06-2013 03:51 PM

Hi guys,

 

To unhide an account you just need to go into the System Preferences > Users & Groups > Unlock the padlock > Control+Click (aka right-click) on the user's name and go into the Advanced Options.

 

From there you can just remove the period from the beginning of the Account Name and the user will be visible again.

 

Note that since only the user can see their own name in this list at first - this means that only the hidden user can unhide themselves.

 

If you also need to unhide the home folder as well, then make sure to remove the period from the Home Directory path and then also the rename actual home folder itself in the /Users/ folder to match.

 

Hope that helps,

Brian

 

User Advanced Options.PNG

by mosese lata(anon) on ‎06-20-2013 02:27 AM

I want Admin Account

by Chris(anon) on ‎07-16-2013 07:31 PM

 

I went in and added a period (.) to the begining of an admin user name, and now that admin account doesn't even show up in the Users & Groups list. How do I unhide the account if it doesn't show up in this list?

 

Thanks!

by Centrify on ‎07-30-2013 10:39 AM

Hi Chris,

 

There are two ways to do this:

 

1. The GUI method:

========================

Login as your hidden user and go into the Users & Groups list again.

You can only see the hidden account while logged in as the account itself.

 

From there you can go into their user Advanced Options as shown above and remove the period from there.

 

Note: If the system hangs with the rainbow cursor while making this change (since we're changing user properties while logged in as the user itself) - just reboot the Mac and you'll be able to login with the non-hidden username again.

 

A little bit hinky... so I recommend you go with:

 

 

 

2. The command-line method:

========================

Login as another user with Local Admin privileges.

Open the Terminal and run the command:

 

sudo dscl . -change /Users/.hiddenadmin RecordName .hiddenadmin hiddenadmin

 

The syntax for this would be:

 

  sudo dscl . -change /Users/.old_hidden_name RecordName .old_hidden_name new_unhidden_name

Post a Comment
Be sure to enter a unique name. You can't reuse a name that's already in use.
Be sure to enter a unique email address. You can't reuse an email address that's already in use.
Type the characters you see in the picture above.Type the words you hear.