Secure Local Administrator Account Creation on macOS

1. Overview & Security Best Practices

Creating and managing local administrator accounts on macOS endpoints requires balancing operational access with zero-trust security principles. Uncontrolled local admin rights expose endpoint fleets to credential harvesting, unauthorized configuration profile removal, and malware execution.

This guide demonstrates how to programmatically create secure local admin accounts using dscl (Directory Service command line utility), assign strong secure tokens, and enforce privilege separation via Jamf Pro or Kandji MDM.

2. Prerequisites

• macOS 12.0 Monterey or later (fully compatible with macOS 15 Sequoia).
• Root or existing administrator privileges on the target endpoint.
• Terminal access or MDM script payload capability.

3. Step-by-Step Automated Shell Script Creation

Below is a production-tested zsh script that creates a hidden local admin account with an auto-generated random 24-character password, provisions a secure token, and logs setup metrics:

#!/bin/zsh
# Script Name: create_local_admin.sh
# Purpose: Programmatically provision a local administrator account on macOS

USERNAME="mactechadmin"
FULLNAME="MacTech Enterprise Admin"
USER_ID="499" # UID under 500 hides user from standard login window

# Check if user already exists
if id "$USERNAME" &>/dev/null; then
    echo "User $USERNAME already exists. Exiting."
    exit 0
fi

# Generate secure random password
PASSWORD=$(openssl rand -base64 18)

# Create Directory Services node
dscl . -create /Users/$USERNAME
dscl . -create /Users/$USERNAME UserShell /bin/zsh
dscl . -create /Users/$USERNAME RealName "$FULLNAME"
dscl . -create /Users/$USERNAME UniqueID "$USER_ID"
dscl . -create /Users/$USERNAME PrimaryGroupID 20 # staff group
dscl . -create /Users/$USERNAME NFSHomeDirectory /var/$USERNAME

# Set password and append to local admin group
dscl . -passwd /Users/$USERNAME "$PASSWORD"
dscl . -append /Groups/admin GroupMembership "$USERNAME"

# Hide account from macOS Login Window UI
defaults write /Library/Preferences/com.apple.loginwindow Hide500Users -bool TRUE

echo "Local admin account $USERNAME created successfully."

4. Managing Local Admin Passwords at Scale (LAPS for Mac)

Static shared administrator passwords are a critical vulnerability. Use an automated LAPS (Local Administrator Password Solution) strategy:

• Jamf LAPS / Kandji LAPS: Automatically rotates local admin passwords every 30 days and stores encrypted credentials in the MDM vault.
• macOS LAPS Open-Source: Leverages FileVault Keychains and local daemon agents to rotate passwords on device boot.

5. Verifying Account Membership & Security Auditing

# List all users with local admin privileges
dscl . -read /Groups/admin GroupMembership

# Check if an account holds a FileVault Secure Token
sysadminctl -secureTokenStatus mactechadmin

6. Frequently Asked Questions (FAQ)