How to Fix the Unknown Group (Permissions)

BACKGROUND

Leopard sets up accounts and permissions differently than Tiger did. In Leopard, users belong to the staff group, while in Tiger they each belonged to their own one-member group named with their short name. Leopard's installation script doesn't migrate the accounts, it just leaves them intact. For example, in Tiger, my XYZ account belong to the XYZ group. Leopard didn't correct that to the staff group (20) or define the XYZ group, so my files belonged to an unknown group. That causes problems with Spotlight and a lot of other stuff.

SOLUTION

The solution requires a separate admin account and enough disk space to make a copy of the home folder.

Prepare for this by unregistering your computer from dot Mac and logging out of it. Also, turn off the Time Machine.

1. Create folders in /Users/Shared that correspond to the folders in the home folder (Desktop, Documents, Library, and so forth)

2. Move the contents of each folder in the home folder to the corresponding folder in /Users/Shared. (For example, contents of Documents to Documents). You cannot just move the folders, because you won't be able to open them from another account.

3. Log off, then log into the separate admin account. Delete the troublesome account, and select the option to delete the Home folder. This is necessary because the troublesome account is irredeemable, and it's the only way you can reuse the short name.

4. Create a new account with the same name, short name, and password as the now-deleted troublesome account and log into it.

5. Open two Finder windows, Sharing and the current account's home folder. Move the files to the current account, but don't overwrite the top-level folders (Desktop, Documents, and so on), move their contents. If you cannot overwrite a folder, open it, and move the contents.

6. When you are working on the /Users/Shared/Library folder, move the Mail folder to the desktop so you can import the mail boxes into your new setup.

7. If you have more than one Mac and you have dot Mac, register the computer and sync now.

8. Import the mailboxes from the Mail folder on your desktop.

Now your user account is ready to use, almost indistinguishable from the old one, except all the permissions are correct and everything works well. There may be a few preferences here and there that you might have to reset.

9. I recommend using Disk Utility to erase the Time Machine disk so you can start over.

This isn't easy, but it less painful than erase-and-install followed by installing all your applications.

24" iMac and 15" MacBook Pro, Mac OS X (10.4.10)

Posted on Nov 18, 2007 6:11 PM

Reply
56 replies

Nov 19, 2007 5:11 AM in response to Tony T1

Someone may tell you that you can boot from the Leopard disk and use the option in the Reset Password program to restore the permissions in a user account. It doesn't work in this situation. I don't think that Apple needs to wait until 10.5.2 to fix this. It would probably be better just to post a script that fixes things.

If something appears to be amiss with your user account, Apple Support often instructs people to create a new account, see if the problem is there also, then move everything over. The problem is that the new account has to have a different name and short name. If you named the account after yourself, that's problematical, unless you are on the way to the courthouse to change your name.

By using the Shared folder as a go-between, you can delete the old account before you add the new one, and that lets you keep the name and short name of the account. That, plus copying the library, means that most of your settings are intact. You may find that some of them haven't taken effect, even though Preferences shows that they are. Just reselect them.

The Library folder is problematical. I recommend that you put the Library/Mail folder on the desktop and use Mail to import the POP mailboxes, because otherwise the POP accounts don't see their mailboxes. IMAP accounts (such as dot Mac) take care of themselves. If you are using dot Mac to synchronize computers, you don't need anything else from the Library/Mail folder; if you are not, you need everything BUT the mailboxes.

Nov 19, 2007 7:55 AM in response to Ken Collins

The above will probably work, but rather than recreating the users and scouring the hard drive to change the group ownerships of files and folders, it might be easier just to fix the group.

The groups migrated from "Panther" or "Tiger" don't have a ' RealName' property. Since it doesn't have a ' RealName', to the "Finder", it is unknown. Apple should probably fix something in that chain, but in the meantime, users with admin privileges can fix the group fairly easily using "/Applications" > "Utilities" > "Terminal.app".

Find out the real group owner of a file displaying "(unknown)" as the group:<pre>
stat -f "%Sg" /path/to/file</pre>

Then check that group ("groupname" in the command below) to see if it has a ' RealName':<pre>
dscl . -read /groups/groupname RealName</pre>

If the result is ' No such key:RealName', then one can be set:<pre>
sudo /usr/bin/dscl . -create /groups/groupname RealName grouprealname</pre>

The new ' RealName' ("grouprealname" in the above example) doesn't have to match the groupname, but it should probably be restricted to alpha-numeric characters. Spaces definitely are not tolerated.

Nov 19, 2007 8:29 AM in response to Ken Collins

in my case it removed the "Unknown User" from all files that I could not remove with the finder... The unknown user in my case was my old Tiger user account... So all my default folders like Documents etc... had "unknown" as owner... incl. all the contents of the folders...

The "unknown" user/group is supposed to be there - it is a default group/user of something "unknown"

I dont know why you would wanna remove that group - it is only "telling" unix what is known and what is not.

Nov 19, 2007 8:49 AM in response to SteveDjokes

The unknown group causes problems--for example, if you try to change the group with the Get Info tab, Finder crashes. It also doesn't play well with Spotlight. All files you create and all applications you install get the unknown group, which means the problem gets worse and worse.

In Tiger, if your account short name is Joe and your account ID is 501, then you belong to group Joe with a group ID of 501. In Leopard, that is an unknown group. Your group is supposed to be staff (20). Leopard's update process doesn't migrate the user accounts.

If there were a way to create a name for the 501 group (as above) and then replace every occurrence of the 501 group with the staff group, it would fix everything.

Apple could issue a script that would fix the problem. The question remaining is: why wasn't Leopard fully tested? And why don't they issue a fix?

Nov 20, 2007 12:02 AM in response to Ken Collins

Incidentally, the unknown group is not a group named "unknown," it is a group that Leopard doesn't know anything about. That is why it causes problems.


Are you sure about that....


Several Applications exist for showing all the owners and groups existing -

number 99 - is "UNKNOWN"

I am NO UNIX expert but it looks to me as if the "Unknown" is supposed to be there...

Nov 20, 2007 5:09 AM in response to Tony T1

You can experiment to find this out.

If you create accounts in Tiger, each account has a GID that is equal to its UID. That is, in your notation: 501:501, 502:502, 503:503, and so forth. That is correct for Tiger and for Panther.

If you create accounts in Leopard, each account has a GID of 20 (staff). That is, 501:20, 502:20, 503:20, and so forth.

If you update from Tiger to Leopard, Leopard doesn't migrate the accounts, it just leaves them intact. Let's say you carried over UIDs 501 and 502 from Tiger, and created 503 and 504 in Leopard. Then the accounts would be as follows: 501:501, 502:502, 503:20, 504:20.

The problem is that GIDs 501 and 502 aren't defined in Leopard. Those groups are unknown, and they cause problems.

Let's suppose you boot from the Leopard disk and use the Password utility to correct the permissions on your directory tree. It changes things, but doesn't fix the problem.

Let's suppose you want to fix this manually. You cannot change a file's group in Get Info, because if the group is unknown, Finder crashes. So you go to Terminal and use chgrp to change all the files in your home directory tree. Then you go to System Preferences | Accounts, unlock it, and right click on your account and change the GID to 20. Then reboot. When you create a new file in that account, for some reason it gets GID 501.

Or you could strip out all extended attributes, or remove all ACLs, and thrash around like that.

However, any account that you create in Leopard is okay.

My wild theory is that Leopard assigns accounts to the staff group and has all those ACLs and extended attributes to meet the UNIX spec. They must have some function, or they wouldn't have gone to all the trouble of adding them.

I think for nongeeks, the best solution is to put the contents in the Shared directory, delete the legacy account, create a new one, and move or copy the files. The new account can have the same name and short name as the deleted one. All the files get the right permissions. If the old account was 501:501, the new account is 501:20, because 501 was unused when you created it.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

How to Fix the Unknown Group (Permissions)

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.