Manage local accounts and groups
Local accounts and groups are held by lpsd, the local principal source.
Use Principals Manager
on the desktop or the lps command
in a terminal to manage them. The guides distinguish changes you can make to
your own account from administrator operations.
Choose a task #
- Create an account: Creating accounts covers credentials, membership and the different first-account provisioning routes. The desktop equivalent is Making a user.
- Change an account or its sign-in policy: Changing a user or the lps reference. A password being set does not by itself require that password at sign-in.
- Create a group or change membership: Groups in Principals Manager or Grouping people together.
- Inspect or change privileges and integrity policy: Assigning privileges. This is the machine's local policy, separate from the account's identity. A policy change affects newly minted sign-in tokens, not existing tokens.
- Change your own password, SSH keys or display name: Sign in links the self-service procedures.
Keep a usable administrator route #
Before changing an administrator's credentials, membership or sign-in access, keep a working administrator session and verify the replacement route. The last-administrator guard checks account state; it does not prove that you can actually sign in through a usable route. SSH configuration changes can end every SSH session, so follow the separate-access precautions there.
Read Disabling rather than deleting before removing an account. Recreating a name does not restore the old SID or the access granted to it.
Understand the model when needed #
Security Fundamentals explains authorities and principal sources, local identity storage, name resolution and privileges. Tool authors and administrators investigating a refused request can consult the local principal interfaces in the technical reference.