why so many hidden accounts?

[osxadmin]

when I do an inventory and collect hidden accounts, some macs show 60+ hidden accounts.
does any knows why so many hidden accounts gets created?

thank you.

[RobertBasil · Accepted solution]

JAMF only creates one hidden account (only creates more if you tell it to do so).

[osxadmin]

interesting thank you @RobertBasil I thought it was strange to see 60+ hidden accounts.

[Look]

If you mean the ones starting with "_" when you use dscl . list /Users , macOS internal service accounts, pretty much every background task seems to have it's own thing going on.

[scentsy]

These are the ones I see.

#!/bin/sh
83  _amavisd    AMaViS Daemon   No  /var/virusmails     No
55  _appleevents    AppleEvents Daemon  No  /var/empty      No
87  _appowner   Application Owner   No  /var/empty      No
79  _appserver  Application Server  No  /var/empty      No
67  _ard    Apple Remote Desktop    No  /var/empty      No
235 _assetcache Asset Cache Service No  /var/empty      No
245 _astris Astris Services No  /var/db/astris      No
97  _atsserver  ATS Server  No  /var/empty      No
229 _avbdeviced Ethernet AVB Device Daemon  No  /var/empty      No
93  _calendar   Calendar    No  /var/empty      No
32  _ces    Certificate Enrollment Service  No  /var/empty      No
82  _clamav ClamAV Daemon   No  /var/virusmails     No
202 _coreaudiod Core Audio Daemon   No  /var/empty      No
236 _coremediaiod   Core Media IO Daemon    No  /var/empty      No
212 _cvmsroot   CVMS Root   No  /var/empty      No
72  _cvs    CVS Server  No  /var/empty      No
77  _cyrus  Cyrus Administrator No  /var/imap       No
59  _devdocs    Developer Documentation No  /var/empty      No
220 _devicemgr  Device Management Server    No  /var/empty      No
244 _displaypolicyd Display Policy Daemon   No  /var/empty      No
241 _distnote   DistNote    No  /var/empty      No
214 _dovecot    Dovecot Administrator   No  /var/empty      No
227 _dovenull   Dovecot Authentication  No  /var/empty      No
215 _dpaudio    DP Audio    No  /var/empty      No
71  _eppc   Apple Events User   No  /var/empty      No
98  _ftp    FTP Daemon  No  /var/empty      No
247 _gamecontrollerd    Game Controller Daemon  No  /var/empty      No
56  _geod   Geo Services Daemon No  /var/db/geod        No
240 _iconservices   IconServices    No  /var/empty      No
25  _installassistant   Install Assistant   No  /var/empty      No
96  _installer  Installer   No  /var/empty      No
84  _jabber Jabber XMPP Server  No  /var/empty      No
218 _kadmin_admin   Kerberos Admin Service  No  /var/empty      No
219 _kadmin_changepw    Kerberos Change Password Service    No  /var/empty      No
234 _krb_anonymous  Open Directory Kerberos Anonymous   No  /var/empty      No
232 _krb_changepw   Open Directory Kerberos Change Password Service No  /var/empty      No
231 _krb_kadmin Open Directory Kerberos Admin Service   No  /var/empty      No
233 _krb_kerberos   Open Directory Kerberos No  /var/empty      No
230 _krb_krbtgt Open Directory Kerberos Ticket Granting Ticket  No  /var/empty      No
246 _krbfast    Kerberos FAST Account   No  /var/empty      No
217 _krbtgt Kerberos Ticket Granting Ticket No  /var/empty      No
239 _launchservicesd    _launchservicesd    No  /var/empty      No
211 _lda    Local Delivery Agent    No  /var/empty      No
205 _locationd  Location Daemon No  /var/db/locationd       No
26  _lp Printing Services   No  /var/spool/cups     No
78  _mailman    Mailman List Server No  /var/empty      No
248 _mbsetupuser    Setup User  No  /var/setup      No
54  _mcxalr MCX AppLaunch   No  /var/empty      No
65  _mdnsresponder  mDNSResponder   No  /var/empty      No
74  _mysql  MySQL Server    No  /var/empty      No
222 _netbios    NetBIOS No  /var/empty      No
228 _netstatistics  Network Statistics Daemon   No  /var/empty      No
24  _networkd   Network Services    No  /var/networkd       No
242 _nsurlsessiond  NSURLSession Daemon No  /var/db/nsurlsessiond       No
243 _nsurlstoraged  NSURLStorage Daemon No  /var/empty      No
249 _ondemand   On Demand Resource Daemon   No  /var/db/ondemand        No
27  _postfix    Postfix Mail Server No  /var/spool/postfix      No
216 _postgres   PostgreSQL Server   No  /var/empty      No
76  _qtss   QuickTime Streaming Server  No  /var/empty      No
60  _sandbox    Seatbelt    No  /var/empty      No
203 _screensaver    Screensaver No  /var/empty      No
31  _scsd   Service Configuration Service   No  /var/empty      No
92  _securityagent  SecurityAgent   No  /var/db/securityagent       No
58  _serialnumberd  Serial Number Daemon    No  /var/empty      No
200 _softwareupdate Software Update Service No  /var/empty      No
89  _spotlight  Spotlight   No  /var/empty      No
75  _sshd   sshd Privilege separation   No  /var/empty      No
73  _svn    SVN Server  No  /var/empty      No
13  _taskgated  Task Gate Daemon    No  /var/empty      No
94  _teamsserver    TeamsServer No  /var/teamsserver        No
210 _timezone   AutoTimeZoneDaemon  No  /var/empty      No
91  _tokend Token Daemon    No  /var/empty      No
208 _trustevaluationagent   Trust Evaluation Agent  No  /var/empty      No
99  _unknown    Unknown User    No  /var/empty      No
95  _update_sharing Update Sharing  No  /var/empty      No
213 _usbmuxd    iPhone OS Device Helper No  /var/db/lockdown        No
4   _uucp   Unix to Unix Copy Protocol  No  /var/spool/uucp     No
224 _warmd  Warm Daemon No  /var/empty      No
221 _webauthserver  Web Auth Server No  /var/empty      No
88  _windowserver   WindowServer    No  /var/empty      No
70  _www    World Wide Web Server   No  /Library/WebServer      No
252 _wwwproxy   WWW Proxy   No  /var/empty      No
251 _xserverdocs    OS X Server Documents Service   No  /var/empty      No
1   daemon  System Services No  /var/root       No
-2  nobody  Unprivileged User   No  /var/empty      No
0   root    System Administrator    Yes /var/root       No

[RobertBasil]

Those are service users. Not accounts.

[scentsy]

are those hidden service users normal? (got it)

[RobertBasil]

Yes, they are normal.

[EThom]

Jamf shows 123 Local user accounts on a lot of my iMacs.  User RobertBasil states these are not local users and are Services accounts?  Why are they listed under Local User Accounts in JAMF?  Am I misunderstanding this?  System files are bogging down our iMacs and I feel like we may have a misconfiguration in jamf.