Directory Services and Account Management
This domain tests how macOS resolves identities, authenticates users, and stores account data across local and directory-backed scopes. Expect questions on local accounts, network accounts, mobile accounts, UID/GID conflicts, and the token model that controls FileVault and management rights.
Account scopes and caching
macOS keeps local accounts in the local directory node, normally /Local/Default. Network accounts come from Active Directory or LDAP; a mobile account caches credentials and home-directory data so the user can log in when the directory server is unreachable. Cached credentials can become stale after a password change made elsewhere. Sharing-only users can access shares but cannot log in at the login window. Use dscl . -list /Users and dscl . -read /Users/shortname to inspect records, and sysadminctl for supported account creation and deletion tasks.
Identity collisions and tokens
Each account needs a unique UID. A local account that reuses an AD user’s UID or short name can cause permission and login failures. On modern macOS, Secure Token controls whether an account can unlock FileVault and approve privileged changes; Bootstrap Token lets MDM perform certain commands on Apple silicon. Do not assume every admin account has a Secure Token.
Worked example
A Mac is bound to AD. A user changes their AD password on another computer, then cannot log in to the Mac while off-network. Reasoning: the Mac has a mobile account with a cached password. The fix is to authenticate once while connected to the directory service, or refresh the mobile account, not to delete the local home folder. After the password change, verify the login keychain password is updated.
Traps
- Deleting an account record does not automatically delete its home folder.
- Do not create ordinary accounts with UID 0; that is reserved for root.
- Avoid manual directory edits when MDM can manage the setting.
- A network account that can authenticate but cannot access files may have a UID or group mapping problem, not a password problem.