How to remove a user from staff group in macOS?

Question

How on earth do I remove one of my local user accounts from the default "staff" group in macOS? I've tried many of the obscure commands in the command-line to no avail, i.e dscl, dseditgroup.

This is what I tried:

$ dsmemberutil checkmembership -U someuser -G staff
user is a member of the group

Tried removing:

$ sudo dseditgroup -o edit -d someuser -t user staff

Checking membership:

$ dsmemberutil checkmembership -U someuser -G staff
user is a member of the group

How come?

I want to remove a particular local account from the staff group so that it doesn't have access to the contents of home directories of other local accounts, amongst other things.

Any commands and/or GUIs that you can recommend for this?

Answer 1

I was also having trouble with this, all the other resources/answers I had found didn't work for me. I finally figured it out (have only tested on my machine on Catalina). This is kind of a kitchen sink approach so some of these steps might be unnecessary, but this is what I did and it worked. I'm not an apple engineer so YMMV and do at your own risk.

Say we want to remove staff group for a user with the name "someuser"

1. Setup a shell script like this: https://superuser.com/a/395738 it'll make debugging easier. Assuming you've saved it in a file members.sh with executable permission, You can double check that it is working by doing:

./members.sh  staff

and seeing if someuser appears in the list.

2. From the system preferences UI create a new group, you can do this by under "Users & Groups" hitting the plus sign and selecting group in the drop-down box. It doesn't matter what you call it, we'll say "new_group"

3. Select that group in the UI and check the box next to "someuser"

4. Right click on "new_group" from the UI and select advanced options, copy the Group ID # (not UUID), it should be a regular number. Say the number is 1234.

5. Now we are going to change someusers's primary group to new_group instead of staff (see also: https://apple.stackexchange.com/a/81553/409162). Do the following:

sudo dscl . -create /Users/someuser PrimaryGroupID 1234

(where 1234 is the number you copied in step 4)

6. Right click on someuser from the UI, select "Advanced Options" and in the "Group" textbox, change "staff" to "new_group". If you close and re-open this "Advanced Options" window it should stay set to new_group.

7. Finally remove the user from staff. Run the following (note: I got this from the "EXAMPLES" section of man dseditgroup you may want to double check there to confirm)

sudo dseditgroup -o edit -u someuser -p -d someuser -t user staff

You may have to enter your password because it is a sudo command, but when it says "Please enter user password" this refers to someusers's password.

8. Run ./members.staff to check that someuser was successfully removed. If someuser is still in the list:
   • Restart your computer
   • Re-run the command in step #7
   • Check again

I've tried this a couple times, sometimes restarting was necessary, other times it wasn't. Sometimes re-running the command was necessary, other times it wasn't