I have added a global password policy which enforces password rotation for every 90 days. But there are two types of accounts:

  1. User Accounts - Enable Password rotation for 90 days
  2. Admin Accounts - No Password rotation

I don't want to enable password rotation for Admin Accounts but should enable for User Accounts. Please suggest a clean approach to achieve this.

Similar Problem: https://www.jamf.com/jamf-nation/discussions/18574/user-password-policies-on-non-ad-machines

(Global Policy = All Users except "admin")

  • Why the difference if it is a risk for user accounts then also a risk for admin
    – mmmmmm
    Commented Nov 13, 2018 at 9:11
  • this will be a chef admin user without an UI and behaves like an API user, is it possible to have two different profiles for each user ? Commented Nov 13, 2018 at 9:53
  • Note that this is not good practice to force password changes you just get password1 password2 etc (and yes I have done that)
    – mmmmmm
    Commented Dec 23, 2022 at 16:02

1 Answer 1


The answers at the link you posted to the JAMF forum gets you most of the way there.

  1. Get all users in the admin group. Running dscacheutil -q group -a name admin will work most of the time, but see the linked answer if it gives you trouble.

  2. For each user, pwpolicy -u $USER -clearaccountpolicies (or set a different policy)


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .