Guest user has become "guest1"

Question

Guest user has become "guest1"

We use networked Macs in a lab setting so we use the userid/password login screen rather than the "click the icons" screen. It turns out that on (at least) one Mac, the short userid for the "Guest" account has become "guest1" (guest followed by the number one).

If we momentarily arrange login so that we can click on the "Guest" icon, it works fine (and creates a "guest1" home directory). To log in using the userid/password pane, though, we have to magically know to use userid "guest1" (with no password), instead of the more intuitive "guest".

I'm suspecting that somehow the "guest" userid got wedged and the Mac helpfully moved on and created a "guest1" account.

How can we restore things so that there's a "guest" account, instead of "guest1"?

various, Mac OS X (10.5.2)

Posted on Mar 26, 2008 11:56 AM

Reply

Answer 1

Mar 29, 2008 6:56 PM in response to DeanPentcheff

Dean,

You are correct: the "Guest" account got auto-bumped into the name "Guest1" because of a pre-existing name conflict. Back when I was running Tiger, I created a homemade "Guest" account. When I upped it to Leopard and activated the built in Guest account, I also had "Guest1". During my attempts to set things right, Leopard created *yet another* account, so I had Guest (from Tiger), Guest1 (from Leopard upgrade), and Guest2! An important thing to note here is that the default UID:GID of the auto-created account should always be 201:201.

I just did this successfully but a few minutes ago, and I remembered your thread's high position during my google search.

Here's what to do:

1) Identify each node in your network which has a Guest1 account. If you don't know this already, you can test each computer with the following commands:

$ /usr/bin/dscl . list /Users | grep -i guest
$ /usr/bin/id Guest
$ /usr/bin/id Guest1

(dscl is the replacement for NetInfo util of previous OS X releases)

2) Turn off the guest user functionality in the System Preferences > Accounts panel.

3) Delete and archive the user-created Guest accounts using the System Preferences > Accounts panel. If you were truly using these as disposable guest accounts, then you really shouldn't have any data worth saving. Also, if the guest account was a member of any weird groups--which a true guest account shouldn't have to be--we'll get to that in a later step. Heaven forbid that any daemons or jobs ran off these guest accounts! Also, I moved the archived .dmg file from /Users/Deleted Users directory as an extra-paranoid step.

4) Delete ALL "Guest-anything" accounts on afflicted nodes (Guest1)

# /usr/bin/sudo /usr/bin/dscl . delete /Users/Guest1

Now your system should have no guest accounts at all, and you should get a blank result from running the above command again:
$ /usr/bin/dscl . list /Users | grep -i guest

5) Restart the computer. Perhaps this is an unnecessary habit of my days as a Windows admin, but just do it, please--I think there was some issue where OS X was still seeing the old name.

6) Enable the Guest account using System Preferences > Accounts panel. Because there are no accounts named "Guest" on the system, the new account will be built and named correctly!

7) Now for some cleanup. Here is an excellent article from the good folks at O'Reilly:
http://www.oreillynet.com/mac/blog/2006/04/deletingmac_os_x_usersremote.html

Not all of the article is applicable here since we're only killing a guest account, but it's sure good for learnin'! Anyway, here's the quick bash loop I wrote to tell me which groups have what users:

$ for xxx in $(/usr/bin/dscl . list /Groups); do echo -n "$xxx : " ; /usr/bin/dscl . read /Groups/$xxx GroupMembership; done | grep -v "No such key:"

Depending on how old your machine is, you might find some remnants of long gone accounts!

Well, that's it. I hope this completely answers your question. I'd like to know either way if I've helped you fully, or if my instructions were somehow wrong. I merely banged out the instructions from memory, this reply is my documentation! And if you already figured this out a better way since your initial posting, I'd like to know how you did it, too.

Thanks!

Foster Lee

Reply

Answer 2

Mar 29, 2008 8:04 PM in response to fosterlee

P.S. I also just discovered that if you CTRL-click the account names in the Accounts panel, there is an option to change the "Short Name". This may be an even quicker way to get your results! Just remember that the Guest Account MUST be 201:201.

Foster Lee

Reply

Answer 3

Apr 15, 2008 4:00 PM in response to fosterlee

Thanks, fosterlee, for giving me the lead on this.

Our situation turned out to be a bit different, due the the way we run our server/client setup. We use a machine group on the Mac server (Leopard) to set the Login characteristics of the clients, including the "Guest" account activation.

So, for our machines, this is the order of events that works ("works" being defined as ending up with a single Guest account on the client, with short username "guest" and userid:groupid of 201:201).

One caution: for a period of time during this procedure, the server-imposed "Login" settings are turned off. That may be a security issue unless you have physical control of ALL client machines while you're doing this. For example, a couple of our machines, when Login settings reverted to local, turned out to be set to autologin into the local administrative user! Ouch.)

1. On the server, change machine "Login" policy setting to "Never". I.e. turn off the server's override of the client login setup. (Note - jot down the "Login" policy settings first -- you'll lose them in the course of this procedure.)

2. Log out on the client, to refresh the login settings.

3. Log into the client with a local administrative user.

4. On the client, turn off the "Guest" user via the SystemPreferences|Accounts panel.

5. Strip out trash "Guest1" info using:
sudo dscl . delete /Users/Guest1

6. Restart the client (maybe paranoid, but like you, I have a ghost of a memory of this being needed at some stage).

7. Log into the client with the local administrative user.

8. On the client, use SystemPreferences|Accounts to turn the Guest user back on, and right-click the "Guest" itme in the user menu of the Accounts panel to confirm that it is UID:GID 201:201 and short username "guest".

9. On the server, turn the machine group profile back to "Always" impose "Login" settings. Note that turning those settings from "Always" to "Never" and back to "Always" resets the damned things, so you have to reselect your desired settings again here.

10. Log out on the client to get the Login settings to refresh.

Whee! Guest login is back.

Reply