All Mac systems should by default have at least one administrator account for installing programs and otherwise changing the system configuration and settings. However, there may be times, when after an OS upgrade or other major system configuration change, that the administrator privileges of an account might get stripped, leaving you with no way to change a number of system settings.
This occurs quite rarely, but if it does happen, one quick but well-known and convenient trick for recovering administrative status on a system is to activate Apple's OS X setup assistant again. This assistant is generally only used once when you install OS X, where it shows a basic interface while running with root privileges to set some core system features, including the first administrator account.
The Setup Assistant is always present on your computer, but only loads once because when it is finished it creates a small file called ".AppleSetupDone" in a hidden folder on the system. When your computer boots it will check for the presence of this file, and then bypass the setup assistant if the file is found.
The convenience of this setup means that you can reactivate the setup assistant to create an administrative account on the computer simply by removing this hidden file and then restarting the computer, which by default should take three steps:
- Reboot into Single User Mode
Restart your computer while holding the Command and S keys, which will drop you to a terminal command prompt. This mode loads you as the "root" user, which gives you full and unrestricted access to every aspect of the system via a command-line interface. This is a very powerful mode to work in, but is very convenient for troubleshooting. - Set the file system to be writable
By default, when booting to Single User Mode the hard drive is set to a read-only state, which ensures that you do not make changes unless you explicitly tell the system to do so. To allow writing to the drive, run the following command:
- Recreate the account
The last step is to go back to the Users & Groups system preferences and create a new account but use the same user name as the previous account (ensure that the "short" name of the account matches the abandoned home folder in the /Users directory). When you do this, the system will detect the old abandoned home folder of the previously deleted account and inform you that a home folder already exists. You can then set the account to access this one so all of the previous accounts' settings and data are applied to the new account.
Security concerns?
This method can be used to reset any administrative account status on any Mac system, and as a result you might be concerned that anyone can make these changes to your system. By default OS X does allow for this; however, there is a quick security measure you can take to prevent it and ensure that only you can perform these actions.
To prevent booting to alternative boot modes (e.g., Single User Mode), you simply have to enable a firmware password on your system. To do this, reboot to the OS X installation drive (be it a DVD or the Recovery HD partition in OS X Lion or later), choose your language when prompted, and then choose "Firmware Password" option in the Utilities menu. Use this tool to set a firmware password, and then nobody will be able to reset PRAM, boot to Safe Mode, Single User Mode, or to alternative boot drives unless they either disable the password or supply it when prompted.
Questions? Comments? Have a fix? Post them below or e-mail us!
Be sure to check us out on Twitter and the CNET Mac forums.