Mac Users Audit
Purpose
The goal of this solution is to audit user accounts available on macOS machines and maintain the collected account information in NinjaOne.
The solution audits both local and directory-based user accounts available through the macOS directory service search path. The collected information includes the username, full name, UID, account type, account status, account source, and last login information.
The solution is designed for macOS machines only and provides a centralized view of user account information through the NinjaOne custom field.
Associated Content
Custom Field
| Content | Type | Function |
|---|---|---|
| cPVAL MAC User Audit | Custom Field | Displays local macOS user account details, including username, account type, status, UID, and last login information. It is updated by Automation - Mac User Audit. |
Automation
| Content | Type | Function |
|---|---|---|
| Mac User Audit | Automation | Audits local and directory based macOS user accounts and updates Custom field - cPVAL MAC User Audit with the collected user account information. |
Group
| Content | Type | Function |
|---|---|---|
| cPVAL Macintosh Machines | Group | A group designated for machines running macOS only. |
Task
| Content | Type | Function |
|---|---|---|
| Audit Mac Users | Task | This task executes the Automation - Mac User Audit daily to identify user accounts on Group - cPVAL Macintosh Machines. |
Implementation
- Import the Custom field - cPVAL MAC User Audit into the NinjaOne environment.
- Import the Automation - Mac User Audit into the NinjaOne environment.
- Create or verify the Group - cPVAL Macintosh Machines group contains only macOS machines.
- Configure the Task - Audit Mac Users to execute the Automation - Mac User Audit daily against the Group - cPVAL Macintosh Machines.
- Verify the custom field after the scheduled task executes to ensure the user account information is being updated as expected.
FAQ
Q: What types of user accounts does this solution audit?
A: The solution audits local and directory-based user accounts that are available through the macOS directory service search path.
Q: Does this solution only audit local macOS users?
A: No. The automation queries the macOS directory service search path, allowing it to identify local users as well as users provided by configured directory services such as Active Directory, LDAP, and cached or mobile accounts.
Q: What information is collected for each user?
A: The solution collects the username, full name, UID, account type, account status, account source, and last login information.
Q: Are macOS system accounts included?
A: No. Accounts with a UID below 500 are excluded to prevent system and service accounts from appearing in the user inventory.
Q: How often is the user information updated?
A: The Task - Audit Mac Users executes the automation daily.
Q: What happens if a Mac does not have a directory service configured?
A: The automation falls back to the local directory and continues to audit the local user accounts on the Mac.
Q: Where are the audit results stored?
A: The collected information is stored in the Custom field - cPVAL MAC User Audit as an HTML-formatted table.
Changelog
2026-08-17
- Initial version of the document