For macOS - list admin users

[bearandy]

In windows we could use relevance: members of local group "administrators"

How could I use it on a macOS computer?

Thanks for help.

[rustymyers]

Unfortunatelye here’s another place where the Mac inspectors are not in parity with the Windows inspectors. It would be idea to use the ‘admin privilege of ’ to determine the users with admin rights, but it only supports Windows and Ubuntu.

Using some older threads I came up with this:

concatenation ", " of strings of values of array "users" of dictionary of file "/private/var/db/dslocal/nodes/Default/groups/admin.plist"

Older threads:
https://www.ibm.com/developerworks/community/forums/html/topic?id=e324ca4d-d537-477d-b7f0-097ea4f546ca

Looking for local admin accounts on Mac OS X

(imported topic written by rzm10291) I’ve had a look at this thread: http://forum.bigfix.com/viewtopic.php?id=30 and some others on how to check for local admins on computers. When I run this command in the recently downloaded Relevance Debugger (Q and A) for Mac: Q: names of local users whose (admin privilege of it) E: The operator “local users” is not defined. The operator is not defined on Mac? Any help is appreciated. TIA Rusty

[jgstew]

Here is an analysis that covers this: https://bigfix.me/analysis/details/2994546

[bearandy]

Thanks for help. We will tried it.

[AlanM]

@rustymyers

but it only supports Windows and Ubuntu.

That older inspector thing we should take down, and it had a bug where every inspector was available on Ubuntu (I have no idea why)

You should always use https://developer.bigfix.com instead as we are actively keeping this one up to date

[Pete_F]

Well it seems that Mojave has struck again…
(number of values of array of value of entry whose(key of it = “users”) of dictionary of file “/var/db/dslocal/nodes/Default/groups/admin.plist”) no longer works as the default folder permissions have changed .

[rustymyers]

Sounds like we’ll have to run a task to output the information to a plist for analysis. Damn it, Apple.

[atlauren]

This is one of those areas where I think an inspector for stdout of with limited access to subcommands would be very useful. In this case, dscl.

[alinder]

Is there already an RFE for this? Has it been requested and denied in the past?

[atlauren]

I haven’t submitted one. I should. But I’ve been saying it so long, in person and in writing, and had feedback from BigFixers indicating they realize the issues of living in an SIP world, that I’m kinda fatigued on the whole thing.

[AlanM]

Please do submit one. This is one of those parity to Windows items we could easily get in if enough people wanted it

[atlauren]

I finally got around to making the RFE:

http://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=130013

[wy937]

@Pete_F

Well it seems that Mojave has struck again…

(number of values of array of value of entry whose(key of it = “users”) of dictionary of file “/var/db/dslocal/nodes/Default/groups/admin.plist”) no longer works as the default folder permissions have changed .

You can get this to work again if you grant the BESAgent process “Full Disk Access”, which you can do manually through System Preferences > Security & Privacy > Privacy > Full Disk Access or with a configuration profile if you have an MDM (also requires DEP or “User Approved” MDM). Look into “Apple TCC” and the “Privacy Preferences Policy Control” config profile payload for more info.