Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to remove a self created daemon user named '_denyhosts' from group 1025(workgroup), 403(, 404( and 405( using Lion Terminal?


To create a reduced privileged daemon user account, to run using launchd, the example on has been helpful.

However the created Lion daemon user account "_denyhosts" seems to have to many groups assigned:

$ id _denyhosts
uid=300(_denyhosts) gid=300(_denyhosts) groups=300(_denyhosts),1025(workgroup),12(everyone),61(localaccounts),403(,404(,405( 

In my opinion the groups membership of:

  1. 1025(workgroup)
  2. 403(
  3. 404(
  4. 405(

can be removed.

I have been trying to accomplish to remove the user its groups memberships using:

$ dscl . -delete /Groups/workgroup GroupMembership _denyhosts
delete: Invalid Path
<dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)

$ dscl . -delete /groups/workgroup GroupMembership _denyhosts
delete: Invalid Path
<dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)

$ sudo dscl . delete /Groups/workgroup GroupMembership _denyhosts
delete: Invalid Path
<dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)

$ sudo dseditgroup -o edit -d _denyhosts -t user workgroup
Username and password must be provided.

I guess that these commands fail because group "workgroup" is not located in a local directory but an LDAP directory:

$ dseditgroup -o -read workgroup | grep AppleMetaNode -A 1
dsAttrTypeStandard:AppleMetaNodeLocation -

But that is not all, because groups are /Local/Default, there $ sudo dseditgroup -o edit -d _denyhosts -t user doesn't output an error, but also doesn't remove the _denyhosts user from the group:

$ id _denyhosts
uid=300(_denyhosts) gid=300(_denyhosts) groups=300(_denyhosts),1025(workgroup),12(everyone),61(localaccounts),403(,404(,405( helped to know that group membership can also be assigned by inheritance. Guess is that such inherited membership is what happens here.

$ dscl . -read /Groups/ | grep NestedGroupsNestedGroups
share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.