# dseditgroup

> Read, create, delete and edit Directory Services group records, including the local admin group.

dseditgroup is Apple's supported command-line tool for manipulating a single named group record on the local Directory Services node or a bound network node such as Active Directory or LDAP. It grants admin rights, populates service access groups and audits membership. An attacker with code execution can run the same operations: a single "-o edit -a" invocation converts a controlled standard account into a local administrator, and the macOS service access control groups (com.apple.access_ssh, com.apple.access_screensharing) gating Remote Login and Screen Sharing are ordinary group records dseditgroup can add members to or delete. It is Apple-signed, is the documented way to change group membership, and runs constantly in MDM workflows.

- Page: https://loobins.io/binaries/dseditgroup/
- Author: Hare Sudhan (@cyb3rbuff)
- Created: 2026-09-20
- Tactics: Persistence, Privilege Escalation, Defense Evasion, Discovery, Lateral Movement

## Paths

- `/usr/sbin/dseditgroup`

## Example Use Cases

### Promote a local account to administrator

Adding a user record to the local "admin" group grants administrator rights, which on macOS include authenticating to authorization prompts, using sudo and installing software. It survives reboots because it changes the local directory database, not a running process. Modifying the admin group requires root, so the command runs under sudo or an already-root context.

```bash
dseditgroup -o edit -a <TARGET_USER> -t user admin
```

- Tactics: Persistence, Privilege Escalation
- Tags: groups

### Edit a group using explicit credentials on a local or network directory node

The -n parameter selects the Directory Services node (the local node "." or a bound LDAP/Active Directory server) and -u/-P supply admin credentials to authenticate against it. With harvested credentials an attacker can add accounts to groups on the local node without a root shell, or on a bound directory server to propagate changes to every Mac bound to that node. The -P password appears in the process argument list.

```bash
dseditgroup -o edit -n /LDAPv3/<DIRECTORY_SERVER> -u <DIR_ADMIN> -P <PASSWORD> -a <TARGET_USER> -t user <GROUP>
```

- Tactics: Privilege Escalation, Lateral Movement
- Tags: ldap

### Grant remote service access through a SACL group

When Remote Login or Screen Sharing is restricted to specific users, macOS enforces it through the com.apple.access_ssh and com.apple.access_screensharing groups. Adding a controlled account to either group opens a remote channel (SSH or GUI) without dropping a payload. The account still needs valid credentials or an authorized key. Requires root.

```bash
dseditgroup -o edit -a <TARGET_USER> -t user com.apple.access_ssh
```

- Tactics: Persistence, Lateral Movement
- Tags: ssh

### Remove a service access group so the service accepts all users

Deleting a com.apple.access_* group record removes the restriction and the service reverts to allowing all users, widening remote access without adding a visible member to an allow list. The -q flag suppresses the delete confirmation, making the operation usable from a non-interactive shell. Requires root.

```bash
dseditgroup -o delete -q com.apple.access_screensharing
```

- Tactics: Defense Evasion, Lateral Movement

### Enumerate group membership to identify privileged accounts

The read and checkmember operations consult the authentication search policy and do not require root. "read" lists all members of a group (admin, com.apple.access_ssh, etc.), and "checkmember -m" tests whether a specific user belongs to it. Either can map who holds administrator rights or service access without writing to the directory.

```bash
dseditgroup -o read admin
```

- Tactics: Discovery
- Tags: groups, enumeration

## Detections

- [Sigma: User Added To Admin Group Via DseditGroup](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_dseditgroup_add_to_admin_group.yml)
- [Elastic: Potential Admin Group Account Addition (dscl or dseditgroup adding to the admin group, excluding known MDM agents)](https://github.com/elastic/detection-rules/blob/main/rules/macos/privilege_escalation_local_user_added_to_admin.toml)
- [Jamf Protect: User Privilege Escalation by dseditgroup and Self Service](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_privilege_escalation_by_dseditgroup_and_jamf_self_service.yaml)

## Resources

- [MITRE ATT&CK T1098.007: Account Manipulation - Additional Local or Domain Groups](https://attack.mitre.org/techniques/T1098/007/)
- [Atomic Red Team T1078.003 Test 5: Add a new/existing user to the admin group using dseditgroup utility - macOS](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-5---add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos)
- [On macOS User Groups - Scripting OS X](https://scriptingosx.com/2018/11/on-macos-user-groups/)
- [Secure Shell (SSH) or Remote Login - ManageMacs wiki (com.apple.access_ssh)](https://github.com/scriptingosx/ManageMacs/wiki/Secure-Shell-(SSH)-or-Remote-Login)
- [Set specific users to use Screen Sharing through command lines - Jamf Nation (com.apple.access_screensharing)](https://community.jamf.com/t5/jamf-pro/set-specific-users-to-use-screen-sharing-through-command-lines/m-p/231888)
- [dseditgroup - SS64 macOS command reference](https://ss64.com/mac/dseditgroup.html)

## Acknowledgements

- Armin Briegel (@scriptingosx) for documenting macOS group records and the com.apple.access_ssh service access group