The 501 orphan problem: why you shouldn’t delete the primary admin user

There’s something rather special about the first admin user account which OS X sets up when you first install it. At a later date, if you try to remove that account, it can store up various strange problems. The simple rule is to do everything that you can to avoid removing that primary admin user.

The reason goes deep down inside OS X’s Unix heart, to the way that it identifies users. Your Mac has long user names, short user names, Bonjour names, and plenty of others, but the Unix heart just knows each user as a number. The primary admin user is always given the unique user ID of 501.

501orphan

Every folder and file on your Mac then has an owner, and a group, in its permissions. Browse permissions using Finder’s Get Info and you will see these expressed as names. So the preference list file, from /Library/Preferences, shown above is owned by me. Only to the Unix code which operates the permissions system, that is not Howard Oakley, or hoakley, but user ID 501.

These days, a lot of the files and folders which make up OS X are owned by the system, but many of those generated during configuration of your Mac and its apps, etc., still have the primary admin user as their creator.

Let’s suppose that, a few months after you set your Mac up, you create a second admin user account, and want to remove the primary account. The user ID for that second account could be anything upwards of 502 – on this Mac, its second admin account has an ID of 507. Suppose you go ahead, log on using the 507 account, exercise your admin privileges, and remove the 501 account.

As an admin user, 507 can still move and remove the great majority of the files and folders which were owned by account 501, if necessary by authenticating with the password. But every single folder and file which was owned by the 501 account has now been orphaned: its owner ID no longer exists.

There are ways of ameliorating the problem. The command line wizard will write a script which whizzes through folders and files and changes those owned by 501 to the remaining admin user, 507. But sooner or later, something somewhere inside OS X will look for user 501, and when it cannot find it, will cause you grief.

There are plenty of people who have deleted the primary admin user account in OS X. But sooner or later it has come back to bite them on the bum, causing strange problems which are tough to diagnose. I have seen it arise with backups, stuck permissions files, and a range of other weird issues. Each time, after a long struggle to understand what was causing the problem, it came back to 501 orphans.

If you really do want to remove the primary admin user, it is worth investing the time to re-install OS X from scratch, and migrate the other accounts (but not the original primary admin user). Then the new primary admin user will have the unique ID of 501, and life will still be beer and skittles.