Problem overview
Devices locked during emergencies or security incidents need a swift and reliable way to restore access once the threat is addressed. This script provides a straightforward solution by unlocking all local user accounts on a macOS endpoint, saving valuable time and effort.
Bash 100s timeout Runs as Local system macOS
#!/bin/bash
# This resource is provided as a convenience for Level users. We cannot
# guarantee it will work in all environments. Please test before deploying
# to your production environment. We welcome contributions to our community
# library
# Level Library
# https://level.io/library/script-macos-unlock-device
# Initialize script-scoped error flag
script_errors=false
# Function to enable all local user accounts (INCLUDING ROOT)
enable_local_accounts() {
echo "Enabling all local user accounts (including root)..."
local_users=$(dscl . list /Users | grep -vE '^(Guest|nobody|_.*|daemon)$')
for user in $local_users; do
sudo pwpolicy -u "$user" enableuser &> /dev/null
if [[ $? -eq 0 ]]; then
echo "Local account $user has been unlocked."
else
echo "ALERT: Failed to unlock local account $user."
script_errors=true
fi
done
}
# Execute actions
enable_local_accounts
if [[ "$script_errors" == true ]]; then
echo "ALERT: Errors occurred during execution. Exiting with code 1."
exit 1
else
echo "All users have been unlocked successfully."
exit 0
fiThis script scans through all valid local user accounts on a macOS device and systematically enables each one. It works in tandem with our macOS Lock Device Script, allowing you to confidently lock down a device when necessary and then revert it to normal operation with a single command. Throughout the process, the device remains connected to Level, enabling full remote control and management.
Use cases
- Restoring normal access after a security lockdown
- Re-enabling valid user accounts post-audit or compliance check
- Quickly returning stolen devices to normal use once recovered
- Coordinating security policy changes with minimal downtime
Recommendations
- Test this script in a controlled environment to ensure compatibility with your macOS endpoints
- Pair with the macOS Lock Device Script to easily toggle between lockdown and normal operation
- Consider using an Automation in Level with a schedule or tag trigger to re-enable accounts after a defined lockout period
- Verify that all necessary user accounts are re-enabled and that each user can sign in properly