I ran the last command in my terminal on my macbook pro high sierra and in the output where entries for the root user. How is that possible? Should that user not be deactivated? Here are the entries for last root:

  • root console Thu Nov 30 09:31 - shutdown (00:00)
  • root console Wed Nov 29 09:23 - shutdown (00:02)
  • root console Wed Nov 22 19:00 - shutdown (00:00)
  • root console Sat Oct 7 22:44 - shutdown (00:00)

Thank you very much for your Help!


These entries are fully normal.

The shutdown needs root priviledges to run, most notably to be able to kill all processes. This doesn't mean that the root user logged on your system, and is totally independant of the fact that the root user is activated.

  • I have one question regarding this, I also have specifically shutdown entries that look like this shutdown ~ Thu Nov 30 15:53 and I don't have any root entries on an other mac with version 10.9.5.. So what is the root accessory needed for? Could someone exploited the recent root bug on my computer? – metro2012 Nov 30 '17 at 19:48
  • @metro2012: On a Mac running Mavericks, you should also find entries like: root console Sat Aug 12 19:07 - shutdown (00:02) meaning that root id was used for 2 seconds and was a session ending on a shutdown of the system. – dan Dec 1 '17 at 11:22
  • @metro2012: I suggest you to make a question about the root access vulnerability on High Sierra. – dan Dec 1 '17 at 11:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .