Script to demote a specific user (account) from admin to standard user

jttavares
New Contributor III

I know this has been asked many times, but I can't seem to find a specific script I can use in a policy to demote a specific user from admin to standard.  All our accounts are local accounts.  We have been doing some auditing and see too many admin accounts out there and are targeting specific users on specific remote/off site Macs.  I have seen scripts that target all users except "admin123" and demote everyone else but that admin account.  I need to specifically target a user by account name.  I am not a good at scripting, which I why I am asking for help.  Appreciate any feedback or suggestions.

Thank You.

1 ACCEPTED SOLUTION

atomczynski
Valued Contributor

You could try the following

Policy
Files and Process
Execute Command

dseditgroup -o edit -d nameoftheusertodemotegoeshere -t user -L admin

 

example

dseditgroup -o edit -d localadministrator -t user -L admin

View solution in original post

2 REPLIES 2

atomczynski
Valued Contributor

You could try the following

Policy
Files and Process
Execute Command

dseditgroup -o edit -d nameoftheusertodemotegoeshere -t user -L admin

 

example

dseditgroup -o edit -d localadministrator -t user -L admin

Thank you!  @atomczynski   I need to learn scripting. I assume I should start with zsh instead of bash?  Any thoughts on that?