User account Advanced Options: shortcut to hell

We seem to have become accustomed to ignoring warnings like Keep off the grass and Are you sure you want to delete all your backups? Here’s one place, though, where you really do ignore its warnings at your own peril, one dialog in which a single keystroke can completely screw your Mac up: the Advanced Options for a user account, in the Users & Groups pane.

You’ll see some articles on the web suggesting that making changes in this dialog will instantly fix problems, or make your Mac secure. Please don’t try this – it really is playing with fire.

Apple hides this dialog away quite carefullly. To see it, open the Users & Groups pane, click on the padlock icon and authenticate, then right-click on a user account in the list at the left. You’ll see a menu pop up with the option Advanced Options…. Select that.

useradvanced01

At the top of the dialog, read and mark Apple’s words very carefully. Changing these settings is almost certain to break something in that account, and if you’re unlucky, you’ll end up having to erase your startup volume and install everything from scratch. If you do make any changes here, particularly to the primary admin account, when your Mac next starts up it will have changed, almost certainly for the worse.

Changing the User ID is really bad news, as permissions throughout your storage depend on that, rather than your user name, for recognising you. Change it to 502, for example, and every file and folder of which you are the current owner, as user 501, will belong to someone else who no longer exists.

Changing the Group, Account name, or Full name have similar pervasively dangerous effects.

The one thing in this dialog which you may find useful is the ability to change your Login shell, provided that you know how to use the shell which you select. At worst, you might get out of your depth in Terminal and have to change this back.

Changing the Home directory is another option with serious consequences. Remember that this doesn’t just alter where your documents, music, etc., are kept, but also your Library containing all your app support files and their preferences.

The next item, UUID, is one which some may suggest you should change, without understanding what it is used for. macOS now associates this, which is actually not a true UUID but a generated UID with the same structure as a UUID, with you as a user. In particular, it is used by Open Directory to identify you as a user, and is listed in your account details in Directory Utility.

Rumours are spreading that the UUID for the primary admin account contains, somehow, personal information about you which Apple uses to track your activity. Those spreading the rumours have produced no evidence that this generated UID contains such embedded information, and Apple doesn’t disclose how it is created.

What is clear and well-documented is that changing the user account UUID has serious consequences, particularly with Open Directory. Even altering a single hex character in it will blow that apart, and cause extensive problems. Please leave it alone.

useradvanced02

To ensure that users don’t fall into this trap, in High Sierra the Advanced Options no longer offer the ability to change the UUID. I suppose conspiracy theorists have an explanation for that.

This dialog is not the best place to change your Apple ID, if you have to do that, and you should avoid tampering with the Aliases too.

Finally, whatever you might do in this dialog, always close it by clicking on the Cancel button, just in case you have inadvertently made any changes that you will regret.

In fairness, this is a potentially useful tool for administering secondary accounts on your Mac. But it is also playing with fire, even if you think you know what you’re doing. And don’t say that Apple and I didn’t warn you.