6

My MacBook Air that I've owned for just days has its own guest account, with its own password. This happened to me once before back in 2013 on a MacBook Pro. Typically, I disable the guest account. However, I recently purchased an open-box MacBook Air from Best Buy. I noticed that sometimes, but not every time, a pixelated Guest account would appear next to my user account when logging in, as seen below:

Photo of login screen with a Guest account and a normal account

Now most of you might tell me that if I have iCloud & Find My Mac enabled, then the Guest account is there by default. This I'm perfectly aware of, and when I enable Find My Mac, this is what I get:

Photo of login screen with two Guest accounts and a normal account

Once again, we have a pixelated guest account which is password protected, and then the guest account enabled with Find My Mac (on the far right) which doesn't require a password.

What is going on here?

Improve this question
13
  • What happens if you run the command dscl . list /Users | grep -v “^_” ? What is does is lists the users. Can you tell us the output from the command? (Note, it shows system users too such as daemon, root, etc..)
    – Matthew
    Commented Nov 13, 2017 at 0:12
  • 1
    @MatthewN Thanks for the suggestion, here is the output:
    – Josh Salganik
    Commented Nov 13, 2017 at 0:26
  • _amavisd _analyticsd _appleevents _applepay _appowner _appserver _appstore _ard _assetcache _astris _atsserver _avbdeviced _calendar _captiveagent _ces _clamav _cmiodalassistants _coreaudiod _coremediaiod _ctkd _cvmsroot _cyrus _datadetectors _devdocs _devicemgr _displaypolicyd _distnote _dovecot _dovenull _dpaudio _eppc _findmydevice _fpsd _ftp _geod _hidd _iconservices _installassistant _installer _jabber _kadmin_admin _kadmin_changepw _krb_anonymous _krb_changepw _krb_kadmin _krb_kerberos _krb_krbtgt
    – Josh Salganik
    Commented Nov 13, 2017 at 0:27
  • _krbfast _krbtgt _launchservicesd _lda _locationd _lp _mailman _mbsetupuser _mcxalr _mdnsresponder _mobileasset _mysql _netbios _netstatistics _networkd _nsurlsessiond _nsurlstoraged _ondemand _postfix _postgres _qtss _sandbox _screensaver _scsd _securityagent _serialnumberd _softwareupdate _spotlight _sshd _svn _taskgated _teamsserver _timed _timezone _tokend _trustevaluationagent _unknown _update_sharing _uucp _warmd _webauthserver _windowserver _www _wwwproxy _xserverdocs daemon nobody opancollc root opancollcs-MacBook-Air:~ opancollc$
    – Josh Salganik
    Commented Nov 13, 2017 at 0:27
  • 1
    Ok, I at least recommend you change all your passwords related to your Apple ID, this includes any password managers you use, your email password and you Apple ID password. Also an anti-virus program can possibly prevent attacks from the person who you believe is doing this. If you want to try to protect you computer and don't want to go to any stores, feel free to ask me. I'm always glad to help.
    – Matthew
    Commented Nov 13, 2017 at 1:53

3 Answers 3

Reset to default
2
+25

If I purchased a open box computer, The first thing I would do is erase the entire internal drive and reinstall the operating system.

My preferred method, for erasing and reinstalling, is to use a flash drive. The instructions are given at How to create a bootable installer for macOS.

Once booted from the flash drive, I usually erase all previous partitions and create a single partition for the installation of macOS. This can be done by using Disk Utility application included on the flash drive. More information can be found at How to reinstall macOS. Look for the section "Decide whether to erase your startup disk".

Improve this answer
5
  • I'm liking the feedback. In no way am I shooting this down, it's logical and makes sense. However, I've done this. First, I'd like to note that I never purchase open box computers. Open box or not, the issues will appear when they do. I have found that the less attention that I give to these problems, the quicker they subside. From February 2014 thru May 2014 - I made a huge mistake by giving this all of my attention, and subsequently, the problems persisted until I finally gave up the fight. I got a new computer, completely exhausted and beat down - gave the symptoms no attention & it stops.
    – Josh Salganik
    Commented Nov 16, 2017 at 5:18
  • Here's another that I would love for someone to explain - Apple sends me a warning 1 time per computer that says - "Another computer on this network is using this computers IP Address." WTF? How is this possible. I came home from work to find my MacMini powered on, and the pop-up was right in the middle of the screen, followed by another message from Apple, "Please contact your system administrator." Once again, who the hell is my sysadmin?
    – Josh Salganik
    Commented Nov 16, 2017 at 5:21
  • 1
    I suppose the system administrator (sysadmin) would be someone who could assign your computer a different IP address if your Local Area Network (LAN) is using fixed IP addresses. Alternatively, if your LAN is using dynamic IP addresses, then the sysadmin could change the DHCP reservation in the router, so your computer would be assigned a different IP address. So I guess the sysadmin is someone who decides how everything connected to your LAN is assigned an IP address. It is the sysadmin's job to make sure each IP address is unique. In your case, you get to be the sysadmin. Good Luck.
    – David Anderson
    Commented Nov 16, 2017 at 6:17
  • @DavidAnderson What you are saying is logical, however keep in mind it's just my fiance & I living in a small apartment. Someone must have intricate knowledge of how our internet provider works, as this is a remote attack. Several times when my computer freezes and I try to force quit everything but nothing moves, I hold down the power buttin. If finder is open during this time, a Remote System Administrator will fash in the sidebar of finder prior to the computer shutting down.
    – Josh Salganik
    Commented Nov 17, 2017 at 20:31
  • @JoshSalganik see "Another device on the network is using your computer's IP address"
    – nekomatic
    Commented Nov 21, 2017 at 15:03
0

My understanding is that the pixelated “Guest Account” is just another user account possibly created when the computer was at BestBuy. If your the administrator (which you should be) of the computer you should remove be able to remove the other account in settings.

Improve this answer
12
  • This "guest account" did not appear in "users" neither when I enabled nor disabled the account. Furthermore, I was not able to even find the account when I launched into recovery mode, opened terminal, and attempted to use the resetpassword command.
    – Josh Salganik
    Commented Nov 6, 2017 at 23:06
  • 1
    @JoshSalganik That seems very suspicious... I would recommend running a anti virus like AVG or Avast to make sure you don't have any viruses, if it doesn't find any and you can't figure out how to remove it I could recommend brining it to an apple store
    – Matthew
    Commented Nov 7, 2017 at 0:56
  • Thank you for your advice. In fact, I did just that. I don't want to give off the wrong vibe - I'm a die hard apple fanatic - but I have not been impressed with those "geniuses" over at the bar. In fact, they had the most "genius" genius look at it and tell me that it was something that I must have done.
    – Josh Salganik
    Commented Nov 7, 2017 at 1:27
  • 1
    @MatthewN I agree but say a supposed hacker gains access to a specific computer and out of spite/revenge (maybe he/she/it knows the "victim") uses tactics to "torment" the victim, knowing that the victim simply lacks the knowledge to fix the problem and thus is rendered helpless. What I'm trying to infer suggests something along the lines of "Hey buddy, look what I can do, and guess what? You cant stop me!" Am I drifting completely off course with this one?
    – Taylor
    Commented Nov 13, 2017 at 0:05
  • 1
    @Taylor That does make a lot of sense actually, thanks for mentioning it. But of course I somehow have an counter argument. If he's trying to torment the victim. In this case, why not make it more obvious then adding a guest user with an odd account picture? When he could literally make an infinite pop-up message with an annoying message. If you ask me thats a pretty good way to torment someone and let them know that they go into their system.
    – Matthew
    Commented Nov 13, 2017 at 0:06
-2

The guest account means you have "Find My Mac" on. Turn off "Find My Mac" and it will disappear.

Improve this answer
1
  • OP has already mentioned Find My Mac in the question, and states that enabling Find My Mac adds another Guest User separate to the one this question is about.
    – grg ♦
    Commented Aug 30, 2018 at 14:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .