Find unexpected Mac admin accounts.

A local admin outside your permanent list might hold approved temporary rights, be a leftover from a previous setup, or need further investigation. This script cannot tell those cases apart. Review its results against your approved accounts and grants before taking action.

As a Jamf Pro extension attribute, it reports at each inventory update so you can group Macs with accounts to review.

What it checks

• Every local account on the Mac, including hidden ones with a UID below 500. Only macOS's own service accounts (names starting with an underscore, plus daemon and nobody) are skipped.
• Whether each account is in the admin group, using dseditgroup -o checkmember. That also catches accounts made admin through a nested group, which reading the group's member list alone would miss.
• Whether the account is on your list of permanent admins. Those are left out of the result.

It reports None, or a comma-separated list of account names. The person logged in at the Mac is marked (logged in).

The script

Download unexpected-admins.zsh or copy it from here. It's MIT licensed, so you can change it and use it however you like. Set PERMANENT_ADMINS to your own permanent admin accounts before you deploy it.

#!/bin/zsh
# SPDX-License-Identifier: MIT
# Copyright (c) 2026 Altiward
#
# Unexpected admins check: a free Jamf Pro extension attribute for macOS, from Altiward.
#
# Lists every local account that holds admin rights but isn't on your list of
# permanent admins (IT's managed or LAPS account, for example). Membership is
# checked with dseditgroup, so accounts made admin through a nested group count
# too, and hidden accounts (UID below 500) aren't skipped.
#
# Output, for Jamf Pro:
#   <result>None</result>
#   <result>jdoe (logged in), support2</result>
#
# "(logged in)" marks the person at the Mac. If they're elevated through
# SAP Privileges when inventory runs, they'll show up here until their rights
# end. This snapshot does not establish whether any listed rights are authorised.
#
# https://altiward.com/guides/find-unexpected-admins/

# Accounts that should always be admin. Separate names with spaces.
PERMANENT_ADMINS=(root)

# Optional: also read the list from a managed preference, so you can change it
# with a configuration profile instead of editing the script. Set the domain
# and key to match your profile, or leave the domain empty to skip it.
PREF_DOMAIN=""                 # e.g. "com.example.unexpected-admins"
PREF_KEY="PermanentAdmins"     # an array of account names

if [[ -n $PREF_DOMAIN ]]; then
  pref_file="/Library/Managed Preferences/${PREF_DOMAIN}.plist"
  if [[ -f $pref_file ]]; then
    i=0
    while name=$(/usr/libexec/PlistBuddy -c "Print :${PREF_KEY}:${i}" "$pref_file" 2>/dev/null); do
      PERMANENT_ADMINS+=("$name")
      (( i++ ))
    done
  fi
fi

console_user=$(/usr/bin/stat -f %Su /dev/console)

found=()
for account in $(/usr/bin/dscl . -list /Users); do
  # Skip macOS's own service accounts.
  case $account in
    _*|daemon|nobody) continue ;;
  esac
  (( ${PERMANENT_ADMINS[(Ie)$account]} )) && continue

  if /usr/sbin/dseditgroup -o checkmember -m "$account" admin >/dev/null 2>&1; then
    if [[ $account == "$console_user" ]]; then
      found+=("$account (logged in)")
    else
      found+=("$account")
    fi
  fi
done

if (( ${#found} == 0 )); then
  echo "<result>None</result>"
else
  echo "<result>${(j:, :)found}</result>"
fi

Add it to Jamf Pro

1. In Jamf Pro, go to Settings, then Computer management, then Extension attributes, and click New.
2. Name it Unexpected admins. Set the data type to String and the input type to Script.
3. Paste in the script, with your PERMANENT_ADMINS list, and save.
4. Create a smart computer group called Macs with unexpected admins, with the criterion Unexpected admins is not None.

Results arrive as each Mac next submits inventory. If you'd rather manage the list of permanent admins with a configuration profile than edit the script, set PREF_DOMAIN to your profile's preference domain and put the names in a PermanentAdmins array.

Using Intune instead

Intune's custom attributes for macOS also run a shell script and report what it prints. Change the two echo lines at the end so they print the result without the <result> tags.

Reading the results

An account marked (logged in) is the person at the Mac. If they had temporary admin through SAP Privileges when inventory ran, that's expected, and they'll drop off the list once their rights end. If they show up on every inventory update, they're probably a permanent admin nobody moved to standard user.

Any other account is outside your permanent-admin list and isn't the current console user. That doesn't establish whether its rights are authorised. Check the account's purpose and grant history before deciding whether to remove its rights or update your list.

What a script can't tell you

An extension attribute is a snapshot, taken whenever inventory runs, often once a day. An account made admin at 10:00 and removed at 10:20 never shows up. The script also runs on a Mac where the person may hold admin rights, so someone determined could stop it reporting them. And it can't tell you whether an admin was granted, only whether the account is on your list.

Altiward adds ongoing agent checks against recorded grants and their expiry, enforcement of rights found past expiry, and findings for detected unexpected admins and missing check-ins. Its agent must be running for those checks to take place. See how it works.

Related guides

• When Mac admin rights outlive their timer
• macOS LAPS and just-in-time admin: which accounts to list as permanent admins