← All artifacts

User Accounts

Local macOS account records from directory services, including hidden and service accounts, with creation, password-change and failed-login times. Password hashes are never collected.

Status
available
CLI plugin
system.users
Categories
system, user

Overview

Every investigation starts with whose machine it is and which accounts exist on it. The User Accounts collector reads the local directory services records and parses one record for every account in the node, including hidden accounts and system or service accounts such as _www.

Each record carries the login name, aliases, real name, UID, GID, generated UID, home directory and shell. It also records whether the account is hidden from the login window, whether it looks like a service account (UID below 500, no UID, or a non-interactive shell), whether a password is set, and whether the account holds a Secure Token. Creation time, password last-set time, failed-login time and failed-login count come from the account policy data embedded in each record, as RFC 3339 UTC timestamps.

Metadata only

The raw account plists contain credential material, so the collector does not copy them. It decodes an allowlist of keys and writes parsed records only. Password hashes (ShadowHashData), Kerberos keys, SRP keys, password hints and account photos never reach the evidence container. Password presence is recorded as a boolean. Each record keeps the SHA-256 of the source plist so you can verify it against the original.

Account list in every manifest

Separately from this plugin, every evidence container records the accounts the collection covered in manifest.json under source.users (username, UID, GID, name, home directory and shell). This is written for every collection, whether or not the plugin runs, and regardless of --plugin or --category filters.

Requirements

On a live Mac the dslocal directory is readable only by root, so run the collector with sudo. Without root the plugin reports itself as not applicable, which is visible in --dry-run. It works without root against a mounted disk image or a --from directory tree.

sudo macfor collect --plugin system.users --output ./evidence.zip
macfor collect --from /Volumes/Image --plugin system.users --output ./evidence.zip

Analysis Tips

  • Find hidden accounts: Filter on hidden: true, or on accounts with a shell and home directory that are not in source.users
  • Check service accounts with login capability: A low UID with an interactive shell, or an unexpected service_account entry, deserves a closer look
  • Compare creation times: An account created shortly before an incident, or outside a deployment window, is a lead
  • Review password and failed-login times: password_last_set_time, failed_login_time and failed_login_count show recent credential activity
  • Check Secure Token: secure_token: true means the account can unlock FileVault

What is not collected

Apple ID linkage, group membership and admin status, login and logout history, deleted accounts, and network or directory (Active Directory, LDAP) accounts are not collected by this plugin.

Related Artifacts

Data sources

*.plistBinary plist

/private/var/db/dslocal/nodes/Default/users/

One directory services record per local account, including embedded account policy data