New user account hijacked folder access permissions on all disks, restricting random folders. How do I fix it?

Question

New user account hijacked folder access permissions on all disks, restricting random folders. How do I fix it?

It begins...

What I have:

I have (#1) a primary internal SSD, formatted APFS, running my daily use High Sierra system (10.13.6)

I have (#2) a secondary internal SSD, formatted APFS, and I just installed a fresh High Sierra system (10.13.6)

I have (#3) a primary external HDD, formatted APFS.

I have (#4) a secondary external HDD, formatted APFS.

What I did:

I migrated my user accounts ("Scott", "Other") from the daily use High Sierra (#1) , to the new High Sierra (#2), using the Migration Assistant app, not the migration option found during High Sierra installation/setup. The new High Sierra (#2) has one throw-away account ("bean") I only made so I could set up the system, and run the Migration Assistant app. Following successful migration, "bean" can be deleted forever, as I will only be using "Scott" (#2), my daily account.

My external HDDs (#3, #4), actually have multiple volumes. All are APFS. Some are storage-only volumes. Some are automated backups of my internal drives (#1, #2), and a few have High Sierra systems I was using to test some things.

Found a problem:

Logged in ("Scott") on the new High Sierra (#2), I happened to be looking through my other drives (#1, #3, #4) and noticed a number of the folders now have the red "minus" circle. When I try to open them, I "don't have permission". Very odd since I never change those settings and both "Scott" and "Other" have always had full access, OR simply get prompted to authorize. The new red "minus" folders don't prompt to authorize. I tried to login as my "Other" account (#2), and that has no access either. I get-info one of the folders, it's locked, and under "Sharing and Permissions", I see *"bean"* has 'read and write', but 'everyone' has 'no access'. "bean" was barely just created, only ran a few hours, and had no tasks beyond the user migration (#1, #2). I'm confused how it changed anything on the external drives (#3, #4), and I wouldn't expect any changes on the previous system (#1) drive either.

A few tests:

In the first no-access folder I found, "Scott" can unlock, and change 'everyone's permission from 'no access' to 'read and write', but "Scott" still can't access it. I can change 'bean' from 'read and write' to 'read only', and "Scott" still has no access. I also tried to delete the 'bean' entry from the 'sharing and permissions' but the "minus" (delete), vanishes when 'bean is selected'. The only way I could finally get access, was to log in as "bean", get info on the same folder, and delete myself 'bean' from the 'sharing and permissions'. Then I log back into "Scott" and the folder is normal again.

On the next no-access folder I found, 'bean' has 'r&w' again, and 'everyone' has 'no access' again. This time I tried adding 'Scott' (while logged in as "Scott") to the 'sharing and permissions' with 'r&w', and that actually worked.

After browsing around all my drives, it seems "bean" got into everything and affected seemingly random folders'' 'sharing and permissions' everywhere. I can't manually search through TB worth of drives and manually correct every no access 'bean' instance.

Help please!

I am very curious how this could even happen, but my priority is fixing it. I also have no idea if it's ongoing and I need to stop that before I fix anything. I did turn off all my auto-backups, and disconnected the external HDDs. I'm honestly afraid to delete the "bean" account in case that means permanent loss of access to things, but I did lower it from Admin to Standard.

How do I stop and/or fix this?

Any more details needed?

Any help is greatly appreciated.

MacBook Pro 17″

Posted on Nov 9, 2023 1:24 PM

Reply

Answer 1

Nov 12, 2023 4:22 PM in response to HWTech

HWTech wrote:

That is normal and expected behavior. The macOS user name is not what macOS uses to determine permissions. macOS assigns a UserID to each macOS user name. It is this UserID which determines permissions. Every OS install, or account migration can result in different UserIDs being assigned to a particular macOS user name. If only one macOS user account is used on each system, then they may have the same UserIDs (or maybe not if that OS had another macOS user account which was previously deleted). UserIDs begin at 501 and increment for each new macOS user account created. Deleting & creating user accounts will make this numbering more complex since macOS may re-use the UserID of a deleted user account.

THANK YOU, this is extremely helpful and you've given me 2 ideas to undo the damage. What do you think?

1. Before migration, "Scott" is 501, and "Other" is 502. "Bean" was also 501 on the new OS. After the migration, they were "Bean" (501), "Scott" (502), and "Other" (503). On the post-migration New OS, can I simply delete "Bean", and renumber "Scott" (to 501), and "Other" (to 502) using Preferences>Users&Groups>AdvancedOptions? Anything orphaned 503 would have no value to me as I never do anything relevant with the "Other" account, which was previously connected to them.

2. I still have the Original OS, and a copy of the pre-migration New OS. Again, before migration, "Scott" is 501, and "Other" is 502. "Bean" was also 501 on the new OS. Can I add 2 new accounts to the pre-migration New OS so one of them will be assigned 503, then delete "Bean" (501) and <new account 2> (502), leaving only <new account 3> (503), THEN run the migration again? Afterwards, I can delete <new account 3> (503) as it's not needed. There should be no number conflicts, and "Scott" (501) and "Other" (502) keep their original numbers.

Problems?

Regarding both ideas... "Bean" permissions currently appear all over all of my drives (since migration). If I can wrap my mind around this, am I correct that they aren't "Bean" permissions, but are "501" permissions, so with either idea above, they STAY as 501, but will show as "Scott"?

Thanks

P.S. I did set my storage-only drives to "ignore ownership on this volume". Looks good so far.

Reply

Answer 2

Nov 13, 2023 12:16 AM in response to HWTech

Again, I really appreciate the help figuring this out.

HWTech wrote:

Scott Bernard wrote:

1. can I simply delete "Bean", and renumber "Scott" (to 501), and "Other" (to 502) using Preferences>Users&Groups>AdvancedOptions?

No. Avoid that Advanced Options area. You can break your system that way.

Gotcha. Yeah, RED warning in there was giving that impression, but I asked just in case.

HWTech wrote:

Scott Bernard wrote:

2. Can I add 2 new accounts to the pre-migration New OS so one of them will be assigned 503, then delete "Bean" (501) and <new account 2> (502), leaving only <new account 3> (503), THEN run the migration again? Afterwards, I can delete <new account 3> (503) as it's not needed. There should be no number conflicts, and "Scott" (501) and "Other" (502) keep their original numbers.

No.

If you want to perform a clean install and another migration, then you can do so, but only migrate one user account at a time in the order you need them so they get the UserID you want for each. Setup Assistant and Migration Assistant allow you to choose which if any user accounts are migrated. When running Migration Assistant later, make sure to uncheck everything except for the specific macOS user account you want transferred.

Clean Install. That may be complicated, but easy question first...

I understand using Setup Assistant to import my first account "Scott" 501. To make this easier, I won't even import my "Other" 502 account. It's empty and I won't lose anything.

With only one account, is it okay let Setup Assistant import EVERYTHING at that point, or were you suggesting doing some parts later in Migration Assistant, or some parts not at all? When I say "everything", normally I would select "Applications", "Other Files & Folders", and "Computer and Network Settings", plus all of "Scott" 501's sub-options, "Music", "Movies", "Pictures", "Desktop".

Thanks

Reply

Answer 3

Nov 12, 2023 12:33 PM in response to Scott Bernard

That is normal and expected behavior. The macOS user name is not what macOS uses to determine permissions. macOS assigns a UserID to each macOS user name. It is this UserID which determines permissions. Every OS install, or account migration can result in different UserIDs being assigned to a particular macOS user name. If only one macOS user account is used on each system, then they may have the same UserIDs (or maybe not if that OS had another macOS user account which was previously deleted). UserIDs begin at 501 and increment for each new macOS user account created. Deleting & creating user accounts will make this numbering more complex since macOS may re-use the UserID of a deleted user account.

If you want to share items between various macOS installations, then the easiest way is to put the data you want shared onto a separate external data only drive where the file system has "Ignore Ownership" selected. Or place items onto a network share like a NAS (you may still need to configure the NAS for dealing with permissions). Or place items into the "/Users/Shared" folder, but you will still encounter permissions issues, but at least you can modify the permissions on items within that "Shared" folder. You can also sync items to the cloud as long as you log into that cloud service using the same account, although some cloud services may allow sharing items to other accounts.

There may be ways to use ACLs or configure a folder to modify permissions of items created or moved into that folder so that no matter which user places a file there, the items can be accessed by anyone sharing the same group. No, I don't know how to do this, but I believe it is possible to do so.

Reply

Answer 4

Nov 12, 2023 9:38 PM in response to Scott Bernard

Scott Bernard wrote:

1. Before migration, "Scott" is 501, and "Other" is 502. "Bean" was also 501 on the new OS. After the migration, they were "Bean" (501), "Scott" (502), and "Other" (503). On the post-migration New OS, can I simply delete "Bean", and renumber "Scott" (to 501), and "Other" (to 502) using Preferences>Users&Groups>AdvancedOptions? Anything orphaned 503 would have no value to me as I never do anything relevant with the "Other" account, which was previously connected to them.

No. Avoid that Advanced Options area. You can break your system that way.

2. I still have the Original OS, and a copy of the pre-migration New OS. Again, before migration, "Scott" is 501, and "Other" is 502. "Bean" was also 501 on the new OS. Can I add 2 new accounts to the pre-migration New OS so one of them will be assigned 503, then delete "Bean" (501) and <new account 2> (502), leaving only <new account 3> (503), THEN run the migration again? Afterwards, I can delete <new account 3> (503) as it's not needed. There should be no number conflicts, and "Scott" (501) and "Other" (502) keep their original numbers.

No.

If you want to perform a clean install and another migration, then you can do so, but only migrate one user account at a time in the order you need them so they get the UserID you want for each. Setup Assistant and Migration Assistant allow you to choose which if any user accounts are migrated. When running Migration Assistant later, make sure to uncheck everything except for the specific macOS user account you want transferred.

Problems?

Regarding both ideas... "Bean" permissions currently appear all over all of my drives (since migration). If I can wrap my mind around this, am I correct that they aren't "Bean" permissions, but are "501" permissions, so with either idea above, they STAY as 501, but will show as "Scott"?

Yes, if Scott has UserID of 501.

Reply

Answer 5

Nov 13, 2023 5:01 PM in response to Scott Bernard

Scott Bernard wrote:

Clean Install. That may be complicated, but easy question first...

I understand using Setup Assistant to import my first account "Scott" 501. To make this easier, I won't even import my "Other" 502 account. It's empty and I won't lose anything.

With only one account, is it okay let Setup Assistant import EVERYTHING at that point, or were you suggesting doing some parts later in Migration Assistant, or some parts not at all? When I say "everything", normally I would select "Applications", "Other Files & Folders", and "Computer and Network Settings", plus all of "Scott" 501's sub-options, "Music", "Movies", "Pictures", "Desktop".

If you are only going to import a single user account so it will have UserID 501, then you can migrate everything else, but avoid any other user accounts since you cannot be sure what order they would be transferred. I meant if you were going to migrate multiple users, then you only need to migrate Applications, Other Files, Computer & Network, etc. just one time since they are located outside of all the user accounts. I also thought you needed to transfer more than one user account so they would all line up with the other system.

If you want user account "Scott" to have UserID 501, then you will need to perform a clean install so that Setup Assistant will migrate Scott from the other system/backup to utilize the first UserID of 501.

Reply

Answer 6

Nov 13, 2023 10:10 PM in response to HWTech

HWTech wrote:

If you are only going to import a single user account so it will have UserID 501, then you can migrate everything else, but avoid any other user accounts since you cannot be sure what order they would be transferred. I meant if you were going to migrate multiple users, then you only need to migrate Applications, Other Files, Computer & Network, etc. just one time since they are located outside of all the user accounts. I also thought you needed to transfer more than one user account so they would all line up with the other system.

If you want user account "Scott" to have UserID 501, then you will need to perform a clean install so that Setup Assistant will migrate Scott from the other system/backup to utilize the first UserID of 501.

Now I understand what you meant.

Scott Bernard wrote:

2. Can I add 2 new accounts to the pre-migration New OS so one of them will be assigned 503, then delete "Bean" (501) and <new account 2> (502), leaving only <new account 3> (503), THEN run the migration again? Afterwards, I can delete <new account 3> (503) as it's not needed. There should be no number conflicts, and "Scott" (501) and "Other" (502) keep their original numbers.

I have a complication with Clean Installs I will explain after.

The copy I kept of the pre-migration New OS is very nearly a Clean Install, with the exception of the 'Bean' user. I also still have the Original OS. I had the room, so I duplicated them and went for my idea #2 I re-quoted above. It worked fine from what I can tell.

I added accounts up to 505 on the pre-migration New OS to be extra careful, and then deleted 501-504. I ran Migration Assistant on "Scott" (501) only, with all the content options selected. It worked, and "Scott"came out as still 501. Out of curiosity, I went back to Migration Assistant and did just the "Other" account as well, and it came out as still 502. Everything looks good, but I've barely used it, so we'll see if anything pops up. I'm perfectly happy to stay here until you point out a flaw, or something self destructs.

The as-concise-as-possible issue with Clean Installs:...

I kept having server/connection issues pop up in various places in my High Sierra some weeks back. I couldn't solve any, even with help, but we were able to trace them at least one cause, something was stopping connections to at least one of Apple's servers. But we couldn't find what was doing it, to fix it. Clean Install seemed like a good idea to bypass the problem and all the minor issues it created.

Now we get some weirdness... Most of the HS clean installs ALREADY HAD THE SAME PROBLEM. I tried downloading a new copy of the HS installer = same thing. BUT, weirdly, I was able to install HS to a couple thumb drives, and those booted up and DIDN'T have the problem. I can't explain how I was getting different installs off the same installer, and I wasn't doing anything to them except logging in. I tried to clone the problem-free HS off the thumb drives, but it refused to boot on a regular drive. I installed dozens of HS clean installs all over, and repeatedly, and couldn't get a problem-free one. No idea how, but after I gave up, I finally got one on a regular drive by accident. Same procedure, but this one is problem-free. I tried to repeat the install, and that one had the problem again.

The way I know these all have the same problem, is because I'm creating and logging in with a throwaway account, and testing for the issues that the server-block causes. This was before I knew user accounts had numbers. I never used my own user account because it was too fat, and a brand new one was faster anyway. When I finally got the problem-free clean install, it already had throwaway "bean" in it, from when I had tested it.

If you are curious for more details on the overall issue, try this thread: https://forums.macrumors.com/threads/nasty-mystery-high-sierra-connection-problem.2409308/

So, when you say "Clean Install", I'm incapable of creating one on demand. I'm sure there's SOME set of conditions that causes the installer to make one problem-free, but I haven't found it yet. If I wanted to try a few dozen installs again, then I would have to use "Scott 501" via Setup Assistant to check each one before full migration. I'm not sure if Setup Assistant can migrate a bare bones of "Scott" just for testing, but if it can, I don't know if Migration Assistant can bring the rest of "Scott" later on if it's a problem-free install and I want to use it.. But I definitely can't test as the full size "Scott" at 750g.

Reply

Answer 7

Nov 14, 2023 7:13 PM in response to Scott Bernard

Scott Bernard wrote:

I have a complication with Clean Installs I will explain...

The as-concise-as-possible issue with Clean Installs:...

...Most of the HS clean installs ALREADY HAD THE SAME PROBLEM. I tried downloading a new copy of the HS installer = same thing... ...I installed dozens of HS clean installs all over, and repeatedly, and couldn't get a problem-free one.

The way I know these all have the same problem, is because I'm creating and logging in with a throwaway account, and testing for the issues that the server-block causes.

...I'm sure there's SOME set of conditions that causes the installer to make one problem-free, but I haven't found it yet. If I wanted to try a few dozen installs again, then I would have to use "Scott 501" via Setup Assistant to check each one before full migration.

Well, I barely posted that, and I had a breakthrough today while testing.

ALL of the Clean Installs have the problem/errors... ...until you restart them 1 time (and update iTunes to 12.8.3).

I'd still rather find the main problem causing the errors, and fix that. But this just made the Clean Install workaround a pleasure.

Reply