I'm trying to run a command at login/logout which requires sudo. I've read about LaunchDaemon and LaunchAgent but as I understand it, LaunchDaemon will run the command at startup with root permissions, and LaunchAgent will run it at login but with the current user permissions, which won't always be an administrator.

Alternatively, is there a way to run my command without the need of sudo? I'm trying to wipe all files in the home directories (Desktop, Documents etc.) on user login/logout so am currently using sudo rm -rf /users/randomuser/Desktop/* etc. Similar to how a guest account works, but without the account being guest and with a little more control. I'm pretty new to this kind of thing so please explain like I'm 5. More than happy to try out another solution if required. Thanks!

EDIT - Thanks for the help so far. Here's a bit more detail about the use case:

I have a mac that will be used by myself (admin) and a few other people (second account). I don't want data to persist between logins on this second account, similar to how the Guest Account works. The problem with the guest account is, it resets applications placed in the dock between logins as well as resetting the desktop wallpaper (which I would like to keep the same throughout logins). My solution was to set up a standard account, lock the dock using defaults write com.apple.Dock size-immutable -bool yes and set the wallpaper manually. As for the data, I would like all files that have been downloaded or transferred by the user to be wiped when the user logs out (or equally, when the next user logs in). Alternatively, If there is a way for the Guest Account to not reset the dock and wallpaper on logout, this would also work. Thanks again!

  • Why not use guest? You are trying to wipe all out and so act as a guest there is only the name kept between logins?
    – mmmmmm
    Commented Jun 29, 2021 at 13:43
  • Why do you need to use sudo for this? If you only delete files/folders belonging to an account, a LaunchAgent should do the job as well.
    – nohillside
    Commented Jun 29, 2021 at 13:58
  • 1
    Yeah, I'd want to know more detail about the use case, as there may be an entirely different course of action that is a better fit to the problem.
    – benwiggy
    Commented Jun 29, 2021 at 14:13
  • Your edit changed the question asked significantly (from „how to run code at login“ to „how to build a customized guest user account“). It might be better to focus on one aspect here, and add additional questions separately
    – nohillside
    Commented Jun 29, 2021 at 15:21

3 Answers 3


Unless the files are created with sudo the user can delete files within his own profile.

So, creating a LaunchAgent that cleans the desktop at login would do the trick.

Login in with the account you want to use for guests.

Create a small script with the following code and save it as /usr/local/bin/cleanDesktop.sh.

rm -rf /Users/$(whoami)/Desktop/* 

Make it executable by running chmod +x /usr/local/bin/cleanDesktop.sh.

Now create a LaunchAgent to run your script. Save the code below as ~/Library/LaunchAgent/com.local.cleanDesktop.plist

and run launchctl load ~/Library/LaunchAgent/com.local.cleanDesktop.plist from the command line.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Warning this code deletes stuff and I did not test it. So use with caution. Also, the user could delete this code. Alternatively you could save the file in /Library/LaunchAgents. Then it won't be editable for standard users. But it will run for all users.

  • Does trhis work if in /Library/LaunchAgents as $HOME won't be set - the user there is root
    – mmmmmm
    Commented Jun 29, 2021 at 14:49
  • Ok, I understand. This will only wipe the desktop of the current user, correct? How would I expand this to encompass all user folders (Documents, Downloads, Movies, Pictures and Music)? Also, I also want to lock the dock (the code i used is in the edited main post), how do I add this in? Thanks again. Commented Jun 29, 2021 at 15:12
  • You've expanded your question. But basically you can anything you want in the /usr/local/bin/cleanDesktop.sh script.
    – Volsk
    Commented Jun 29, 2021 at 15:17
  • Ok so the script is running at login, but the files aren't being wiped. My dock is locking however, so I know the script is running. Commented Jun 29, 2021 at 15:42
  • I see I made a typo. I corrected it. /User --> /Users
    – Volsk
    Commented Jun 29, 2021 at 19:46

It is a bad idea to call sudo to remove files. Sudo may ask for the password and since it isn't entered it may fail. And yes, there are situations where you need to call sudo to remove your own files. Simply clone a Git repository to your desktop. The Git metadata will prevent a 'normal' rm from working.

You could utilize MacOS' Login/Logout hooks as long they work on your machine. I expect Apple to remove them some day.

LoginHook.sh - commands to be executed as root when a user logs in. $1 is the user name, consider this being a sample script:


echo "" > $logfile

if [ -d /Users/$user/Library/Login ] ; then
    cd /Users/$user/Library/Login
    for s in *
        echo `su -l $user -c /Users/$user/Library/Login/$s` >> $logfile

LogoutHook.sh - commands to be executed as root when a user logs out. $1 is the user name, consider this being a sample script:


echo "" > $logfile

if [ -d /Users/$user/Library/Logout ] ; then
    cd /Users/$user/Library/Logout
    for s in *
        echo `su -l $user -c /Users/$user/Library/Logout/$s` >> $logfile


mkdir /Library/LoginWindowScripts
cp LoginHook.sh /Library/LoginWindowScripts/LoginHook.sh
cp LogoutHook.sh /Library/LoginWindowScripts/LogoutHook.sh
chmod 755 /Library/LoginWindowScripts/LoginHook.sh
chmod 755 /Library/LoginWindowScripts/LogoutHook.sh
defaults write com.apple.loginwindow LoginHook /Library/LoginWindowScripts/LoginHook.sh
defaults write com.apple.loginwindow LogoutHook /Library/LoginWindowScripts/LogoutHook.sh

Per user installation:

mkdir ~/Library/Login && mkdir ~/Library/Logout

Users place their personal scripts to these folders and make them executable. The scripts may not launch any app.

--- EDIT ---

As of today, only the logout hook seems to work.

  • 1
    I never had to use sudo to remove git metadata. Some files in .git may be read-only, but a simple rm -f solves this.
    – nohillside
    Commented May 31, 2022 at 6:00

I have detailed the process I used to run a script as root at any users login here: Hiding default folders via launchagent: not applying to documents

I'm afraid that I do not know how to run on logout without using logout hooks, which I would not recommend as Apple have been trying to depreciate this for years.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .