Convert User to Admin Account Command Line Mac

To convert a standard user account to an administrator account on macOS using the command line, you use the dscl command to add the user to the admin group. The exact command is sudo dscl . -append /Groups/admin GroupMembership username, which grants the user full administrative privileges immediately.

Background: How macOS Account Privileges Work

macOS separates user accounts into two main privilege levels: standard users and administrators. A standard user can only modify files and settings in their own home directory, while an administrator can install software, change system-wide settings, and manage other user accounts. The system enforces this through group membership—specifically, the admin group. Any user in this group receives the ability to use sudo and access administrative functions in System Settings.

When you create a new account through System Settings, you choose whether it is “Standard� or “Administrator.� However, you might need to change this later—for example, if you set up a guest or child account and now want to grant it full control, or if you are troubleshooting a Mac where the only admin account is locked out. The command line gives you a direct way to make this change without navigating the GUI.

Prerequisites and Preparation

Before you run any command, you must ensure you have the following:

• An existing administrator account on the Mac, because you need sudo privileges to modify group membership.
• The exact username of the account you want to convert. You can find this by running dscl . -list /Users or by checking the home folder name in /Users/.
• Terminal access, which you can open from /Applications/Utilities/Terminal.app.

If you are currently logged in as the user you want to convert, you can still run the command from that account, but you will need to enter the password of an existing administrator when prompted by sudo. If no other admin exists, you will need to boot into Recovery Mode and use the “Reset Passwordâ€� utility or the terminal there to enable the root user—a more advanced procedure.

Step-by-Step: The Command to Convert

Follow these steps exactly. Replacing username with the actual short name of the target account.

1. Open Terminal.
2. Type the following command and press Enter:
   sudo dscl . -append /Groups/admin GroupMembership username
3. Enter your administrator password when prompted. The command produces no output if successful.
4. Verify the change by running:
   dscl . -read /Groups/admin GroupMembership
   You should see the username listed among the members.
5. Log out and back in (or restart) for the change to take full effect in the GUI.

That’s it. The user now has administrator privileges. To revert, use sudo dscl . -delete /Groups/admin GroupMembership username.

How It Works: The dscl Command Explained

dscl stands for “Directory Service Command Line.â€� It is the low-level tool for interacting with macOS’s directory services, which store user and group information. The . refers to the local directory (the Mac itself). /Groups/admin is the path to the admin group record. GroupMembership is the attribute that holds the list of usernames in that group.

The -append flag adds the username to the existing list without removing others. If you used -create instead, it would overwrite the entire list, which could remove all other admins—dangerous. Always use -append unless you are intentionally rebuilding the group.

An alternative method is to use the dseditgroup command: sudo dseditgroup -o edit -a username -t user admin. This achieves the same result and is considered more modern. Both work on macOS Ventura, Sonoma, and Sequoia.

Common Problems and Troubleshooting

If the command fails or the user still cannot perform admin actions, check the following:

• Username typo: The username is case-sensitive. Run dscl . -list /Users to see the exact names.
• Group membership not updated: Some GUI processes cache group membership. Log out completely or restart.
• SIP or file integrity protection: On Apple Silicon Macs, modifying system files is restricted, but group membership via dscl is allowed. If you get a “Permission deniedâ€� error, you may have typed the command wrong or you are not using sudo.
• User is hidden: If the account is a hidden system user (like _mysql), adding it to admin can break security. Only convert real user accounts.
• No admin account available: If you are locked out, you cannot run sudo. You will need to boot into Recovery Mode (hold Command+R at startup) and use Terminal there to run the same dscl command, but the path to the system volume may differ—you may need to use /Volumes/Macintosh HD as the root. This is complex and should be done carefully.

Security Considerations and Risks

Granting admin privileges gives the user the ability to install software, change system files, and access all other users’ data (with password). This is a significant security decision. Only convert accounts you trust. For a family Mac, it is common to keep children on standard accounts and only give one adult admin rights.

Also, be aware that if the account is a managed Apple ID (like a child’s account under Screen Time), converting it to admin may bypass parental controls. Apple’s documentation recommends keeping managed accounts as standard. If you encounter issues with Screen Time after conversion, you may need to remove the account from the family group first.

Alternatives: GUI and Other Methods

If you prefer not to use the command line, you can convert the account through System Settings:

1. Go to System Settings → Users & Groups.
2. Click the lock and enter an admin password.
3. Select the user, then click “Allow user to administer this computer� (or the “Admin� checkbox in older macOS versions).

This is the simplest method for most people. The command line is useful when you need to automate the process, manage multiple Macs remotely, or when the GUI is not available (e.g., during recovery). Another alternative is using sysadminctl: sudo sysadminctl -adminUser adminUsername -adminPassword adminPassword -addUser username -admin, but this creates a new user, not converts an existing one.

Frequently Asked Questions

Can I convert the current logged-in user to admin without another admin?
No. You need an existing admin to authorize the change via sudo. If you are the only user and it is standard, you must boot into Recovery Mode and use Terminal there to enable the root user or reset the account type. This is more involved and should be done only if you know the recovery password.

What is the difference between dscl and dseditgroup?
Both modify directory service records. dseditgroup is a higher-level tool specifically for group management and is less error-prone because it automatically handles the correct attribute. dscl is the raw interface. For this task, either works; dseditgroup is recommended for scripting.

Will the user need to restart their Mac?
No, a restart is not required. Logging out and back in is sufficient. Some applications may need to be relaunched to recognize the new privileges.

How do I check if a user is already an admin?
Run dscl . -read /Groups/admin GroupMembership and look for the username. Alternatively, in System Settings, the user will have “Administratorâ€� listed under their name.

Can I convert a user to admin while they are logged in?
Yes, you can run the command from the target user’s session if you know an admin password. The change takes effect immediately for new processes, but the user may need to log out for the GUI to fully reflect it.

Is there a way to convert without using sudo?
No, modifying group membership requires root privileges. You must use sudo or be logged in as root.

Related

• GTA 6 Platform Check: Which Systems Get It
• What Feathers Reveal About Dinosaur Behavior
• Apache Default Page Showing Instead of WordPress: Fix