How can I temporarily suspend some users, hiding them from the login screen?

Question

I have to manage a shared OSX workstation that is used by a rotating cast of characters throughout the year. The login screen quickly becomes cumbersome when users that aren't even around for a while are listed and cluttering up the clumsy horizontal scroll.

How can I clean up the login screen without nuking accounts that would need to get re-created at a later time?

Additionally, when somebody is gone for an extended period I would like their account to be locked so it can't be used locally or remotely, but I don't want to nuke users passwords, when they come back a quick admin action should get them back into the system again?

Answer 1

This can be accomplished using a feature of the unix based login system that assigns a program to run on successfully login. Normally users in OSX have their shell defined as /bin/bash. The OS login window will actually make sure people have a usable shell before showing them on the login screen.

You can disable a user — revoking both their ability to login and their appearance in the login window user list — by changing the shell to /usr/bin/false.

The settings is found in System Preferences -> Users & Groups -> (Unlock the settings if necessary) -> Right click on a user -> Advanced options -> Login Shell.

Re-enabling the user is as simple as setting this back to /bin/bash.