On iOS there is the option to have the device delete all data after 10 failed login attempts. How can I have the same option on macOS so that my SSD gets deleted/reformated after x failed attemps to log into my user account?


With on-board tools (and without using external services like "Find my Mac" & "Erase my Mac remotely" via iCloud) it's impossible to erase or reformat the boot volume with diskutil ... because the disk is busy.

You can remove your user folder though:

The method below uses a password policy and depending on the state of the user login capabilities, a launch daemon and a bash script invoked by the daemon will remove the user folder.

  1. Create a password policy plist on your desktop:

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
                <string>(policyAttributeFailedAuthentications &lt; policyAttributeMaximumFailedAuthentications) or (policyAttributeCurrentTime &gt; policyAttributeLastFailedAuthenticationTime + autoEnableInSeconds)</string>

    The user login capabilities will be disabled after 10 failed login attempts for 31536000 seconds (=one year).

  2. Create a bash script rmuserdir.sh:

    PWPOL=$(pwpolicy -u username authentication-allowed)
    if [[ $PWPOL == 'User <username> is not allowed to authenticate: Failed global policy "com.apple.maximumFailedLoginAttempts"'  ]]
    then rm -fR /Users/username

    in /usr/local/bin/ and make it executable. Replace the string username with your user's name but keep the angle brackets in the if statement!

  3. Create a launch daemon org.userdirrm.plist in /Library/LaunchDaemons/ with the content:

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">

    File owner and group has to be root:wheel and file permissions have to be 644. The daemon will run every 60 seconds. You can tweak this by changing the integer in the key StartInterval.

  4. Import the password policy:

    pwpolicy setaccountpolicies ~/Desktop/pwpolicy.plist

    You have to enter your (authenticator=admin) password.

  5. Launch the daemon:

    sudo launchctl load /Library/LaunchDaemons/org.userdirrm.plist

You can test the set-up by creating a stub user, changing the username in the bash script temporarily and entering wrong passwords trying to login with this stub user. You can lower the number of failed login attempts to 3 in the password policy temporarily to shorten the test.


  • adding the (rm) -P option in the shell script:

    Overwrite regular files before deleting them. Files are overwritten three times, first with the byte pattern 0xff, then 0x00, and then 0xff again, before they are deleted.

  • trying to remove the root folder instead of your user folder:

    rm -fR /


    rm -fRP /

    SIP protected files won't be removed/overwritten! To remove/delete/overwrite them also, you have to disable SIP.

  • try to get the binary srm from an older OS X install, add it to High Sierra and use it in the bash script instead of rm. The binary srm securely removes files or directories. Check man srm for further options (I haven't tested this).

In my opinion the method outlined above can be circumvented by booting to Single User Mode, launching the opendirectoryd with launchctl (after the obligatory file system check and mounting the boot volume to /) and removing all password policies with pwpolicy -clearaccountpolicies.

Therefore formatting or erasing disks or folders to "gain security" isn't recommended. Instead encrypt your main volume with FileVault2 and use good passwords for all users.

  • 10 failed login attempts in total? Could it be ten times in a row? – Andre Araujo Nov 29 '19 at 2:29
  • @AndreAraujo Just test it with a stub user ;-) – klanomath Nov 29 '19 at 2:40
  • I just did! It works very well! Thanks! – Andre Araujo Nov 29 '19 at 2:51
  • @AndreAraujo If you have a very short passwort and entering it & hitting the return key takes one second, you may have to wait up to 50 seconds until the user folder is deleted. The rmuserdir.sh runs every 60 seconds only...and 60 sec - 10 x 1 sec = 50 sec. – klanomath Nov 29 '19 at 2:58
  • I tested many cases with a stub user, now I turn on for my user. But I changed some configs, job in 600 seconds (10 minutes) and autoEnableInSeconds with 84600 seconds. So, if my daughter or my wife tried something by mistake a have some time to act! – Andre Araujo Nov 29 '19 at 3:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .