Currently Being ModeratedFeb 29, 2012 10:59 AM (in response to psnow85)
I'm trying to do the same thing, however instead of having a list of specific users to keep, I'm focusing on the script just keeping the ADMIN accounts (which happens to be a local user), and deleting all the rest of the accounts in the /Users folder.
Have you had any luck with this yet?
Currently Being ModeratedFeb 29, 2012 12:00 PM (in response to psnow85)
the basic applescript would be something like, which you should be able to modify to use through ARD:
-- parse list of short user names of current accounts
set currentUserList to paragraphs of (do shell script "dscl . -list /Users")
-- parse list of alowed accounts; file should be a return delimited list of short user names
set allowedUserList to paragraphs of (read "/path/to/textfile.txt")
repeat with thisUser in currentUserList
if thisUser is not in allowedUserList then
do shell script "dscl . -delete /Users/" & thisUser
do shell script "rm -rf /Users/" & thisUser
be very careful: "dscl . -list /Users" will include a ton of hidden system accounts that you should not delete if you want your computer to continue working - you'll either have to find a better way of generating the list or do something to make sure those accounts (and any future accounts apple might add) are preserved.
to do this retaining only admin accounts, you'll need to find away to get the system to tell you which accounts are admins. I'm not sure how to do that, but I'm looking into it; dscl and account administration isn't really in my strong suit.
Currently Being ModeratedMar 1, 2012 1:05 PM (in response to twtwtw)
Actually, I got this to work as a LogoutHook.
# Logout script to remove nonadmin accounts from Users folder
# If user is an admin, exit script
if [ $USER = "usernametosave" ]; then
# the next 2 lines could be substituted for the previous line
# dscl . -read /Groups/admin GroupMembership | grep -q "$USER"
# if [ "$? -eq 0"]; then
echo "LOGOUT: admin folders will not be deleted."
# If home directory exists, delete
if [ -d "/Users/$USER" ]; then
echo "LOGOUT: user account cleanup."
rm -R /Users/"$USER"
dscl . -delete /Users/"$USER"
And then you make the script executable and write to the com.apple.loginwindow file. Then each time someone logs out it runs the script.
Currently Being ModeratedMar 1, 2012 1:30 PM (in response to ipanacea)
beats me why you don't just use Guest accounts. Easy to configure, and saves the trouble of running a script.
Currently Being ModeratedMar 2, 2012 6:09 AM (in response to twtwtw)
I agree, Guest accounts make it much easier, however not all environments often like to use the easy route.
Currently Being ModeratedApr 19, 2012 6:18 AM (in response to ipanacea)
I shoved the script above into apple script editor and it came up with all kinds of syntax errors. What xactly needs to be edited or replaced in the above?