After upgrading to El Capitan from Yosemite, my main administration account was removed. After recovering it by forcing the first time setup to run again, I am now unable to change system settings. For example, if I open up "Users and Groups" and click the lock to make changes, it prompts for my password. I enter my password (that has admin privileges) and it accepts it, but the lock status doesn't change. I've also upgraded XCode to v7, and it prompts for my password to accept the license agreement. If I enter it incorrectly, I get the shaky box, but if I enter it correctly, it accepts it, but the license agreement box doesn't go away.

I've attempted to resolve this by turning off SIP and by using the "resetpassword" utility on both the Root Admin and my user's account and neither option has worked.

I'm out of ideas here- hoping one of you can help. Thanks in advance.


So I ran dscacheutil and shows two entries for root user. Does that mean anything?

enter image description here

  • Have you tried a reinstall? – At0mic Oct 5 '15 at 3:29
  • If you can, open System Prefs > Users & Groups > Unlock > Right click your account > Advanced options. Are you number 501 ? If not, I think a reinstall & recovery from Time Machine might be simplest. – Tetsujin Oct 5 '15 at 7:12
  • @Tetsujin I can't perform the "Unlock" step of your suggestion (kind of the reason for this question), but I performed dscacheutil -q user | grep -A 3 -B 2 -e uid:\ 5'[0-9][0-9]' and it showed my user as uid: 501 – dfran02 Oct 5 '15 at 10:29
  • ah, OK, there goes my theory ;) I once had a restore/migrate where my main account ended up as 502 & I had great fun restoring it to 501 – Tetsujin Oct 5 '15 at 10:31
  • @IronCraftMan Yes, I've reinstalled from a bootable USB and from the recovery partition. Neither have changed anything. – dfran02 Oct 6 '15 at 16:00

If you are using Centrify, then this thread led me to this Apple forums answer: let the system rebuild the authentication database:

sudo mv /var/db/auth.db /var/db/auth.db.old

and restart. This fixed all the related privilege escalation failures for me and I seem to recall a Centrify upgrade was supposed to be done before the Mavericks upgrade too.

It has not, however, re-enabled network user logon. The check-box to allow network user logon is missing from Users & Groups still.

| improve this answer | |
  • I ended up doing a clean OSX install. I am using Centrify though, so I'm going to go ahead and mark this as the answer. – dfran02 Oct 27 '15 at 15:57
  • I should add that installing the updated Centrify package with El Capitan compatibility fixed network user logon. – Sam Brightman Oct 27 '15 at 19:11
  • Thanks a lot for this information! I never figured that Centrify was the culprit, but from now on this will be included in my initial search terms ... :-) – DaDaDom Nov 4 '15 at 10:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .