Creating Custom Guest Users on OS X

If you want others to be able to temporarily use your computer, but you don’t want to create an account for each user, Mac OS X allows you to create a guest account. This guest account allows a person to log in to the Mac without entering a password, but the account type has the following limitations:

1. Guest users can’t make changes to other user accounts.
2. Guest users can’t change setting on the computer.
3. Guest users can’t log in remotely.
4. Files created by guest users are deleted when the user logs out. As part of this, a temporary home folder is created for the guest’s files but this folder and its contents are deleted when the user logs out.

By default, OS X only allows the creation of a single guest account with the name of Guest. That said, it is possible to create custom guest accounts with names that are different from Guest. This would allow Mac admins to create multiple guest accounts if needed. See below the jump for more details.

I’ve built a script for creating a custom guest account, based on earlier work by Noel B. Alonso. The script is available below and has been tested on Mac OS X 10.6.8 – 10.9.1.

	#!/bin/bash
	# Original script by Noel B. Alonso: https://gist.github.com/nbalonso/5696340
	#variables
	DSCL="/usr/bin/dscl"
	SECURITY="/usr/bin/security"
	LOGGER="/usr/bin/logger"
	# Determine OS version
	OSVERS=$(sw_vers -productVersion | awk -F. '{print $2}')
	# Set the account shortname
	USERNAME="kiosk"
	# Set the name which is displayed in System Preferences for the account
	DISPLAYNAME="Kiosk User"
	# Set the account's UID
	GUESTUID="600"
	# Set the account's GID
	GUESTGROUPID="600"
	if [[ ${OSVERS} -lt 6 ]]; then
	${LOGGER} -s -t create"${USERNAME}".sh "ERROR: The version of OS X running on this Mac is not supported by this script. User account not created."
	fi
	if [[ ${OSVERS} -eq 6 ]]; then
	${LOGGER} -s -t create"${USERNAME}".sh "INFO: Creating the "${USERNAME}" user account on Mac OS X 10.${OSVERS}.x"
	${DSCL} . -create /Users/"${USERNAME}"
	${DSCL} . -create /Users/"${USERNAME}" UserShell /bin/bash
	${DSCL} . -create /Users/"${USERNAME}" RealName "${DISPLAYNAME}"
	${DSCL} . -create /Users/"${USERNAME}" UniqueID "${GUESTUID}"
	${DSCL} . -create /Users/"${USERNAME}" PrimaryGroupID "${GUESTGROUPID}"
	${DSCL} . -create /Users/"${USERNAME}" NFSHomeDirectory /Users/"${USERNAME}"
	${DSCL} . -create /Users/"${USERNAME}" RecordType dsRecTypeStandard:Users
	${DSCL} . -create /Users/"${USERNAME}" dsAttrTypeNative:_defaultLanguage en
	${DSCL} . -create /Users/"${USERNAME}" dsAttrTypeNative:_guest true
	${DSCL} . -create /Users/"${USERNAME}" dsAttrTypeNative:_writers__defaultLanguage "${USERNAME}"
	${DSCL} . -create /Users/"${USERNAME}" dsAttrTypeNative:_writers_jpegphoto "${USERNAME}"
	${DSCL} . -create /Users/"${USERNAME}" dsAttrTypeNative:_writers_LinkedIdentity "${USERNAME}"
	${DSCL} . -create /Users/"${USERNAME}" dsAttrTypeNative:_writers_picture "${USERNAME}"
	${DSCL} . -create /Users/"${USERNAME}" dsAttrTypeNative:_writers_UserCertificate "${USERNAME}"
	${DSCL} . -create /Users/"${USERNAME}" AppleMetaNodeLocation /Local/Default
	#setting up an empty password and giving local Kerberos some time to process it
	${DSCL} . -passwd /Users/"${USERNAME}" ''
	sleep 2
	fi
	if [[ ${OSVERS} -ge 7 ]]; then
	${LOGGER} -s -t create"${USERNAME}".sh "INFO: Creating the "${USERNAME}" user account on Mac OS X 10.${OSVERS}.x"
	${DSCL} . -create /Users/"${USERNAME}"
	${DSCL} . -create /Users/"${USERNAME}" dsAttrTypeNative:_defaultLanguage en
	${DSCL} . -create /Users/"${USERNAME}" dsAttrTypeNative:_guest true
	${DSCL} . -create /Users/"${USERNAME}" dsAttrTypeNative:_writers__defaultLanguage "${USERNAME}"
	# Adding the _writers_LinkedIdentity attribute for Macs running Mac OS X 10.7.x. This
	# attribute is not needed on 10.8.x and later.
	if [[ ${OSVERS} -eq 7 ]]; then
	${DSCL} . -create /Users/"${USERNAME}" dsAttrTypeNative:_writers_LinkedIdentity "${USERNAME}"
	fi
	${DSCL} . -create /Users/"${USERNAME}" dsAttrTypeNative:_writers_UserCertificate "${USERNAME}"
	${DSCL} . -create /Users/"${USERNAME}" AuthenticationHint ''
	${DSCL} . -create /Users/"${USERNAME}" NFSHomeDirectory /Users/"${USERNAME}"
	#setting up an empty password and giving local Kerberos some time to process it
	${DSCL} . -passwd /Users/"${USERNAME}" ''
	sleep 2
	${DSCL} . -create /Users/"${USERNAME}" Picture "/Library/User Pictures/Nature/Leaf.tif"
	${DSCL} . -create /Users/"${USERNAME}" PrimaryGroupID "${GUESTGROUPID}"
	${DSCL} . -create /Users/"${USERNAME}" RealName "${DISPLAYNAME}"
	${DSCL} . -create /Users/"${USERNAME}" RecordName "${USERNAME}"
	${DSCL} . -create /Users/"${USERNAME}" UniqueID "${GUESTUID}"
	${DSCL} . -create /Users/"${USERNAME}" UserShell /bin/bash
	#Adding the keychain item that allows "${USERNAME}" to login in 10.7 and later.
	${SECURITY} add-generic-password -a "${USERNAME}" -s com.apple.loginwindow.guest-account -D "application password" /Library/Keychains/System.keychain
	fi
	${LOGGER} -s -t create"${USERNAME}".sh "INFO: Exiting"
	exit 0

view raw

gistfile1.sh

hosted with ❤ by GitHub

I also have this script available on my GitHub repo:

https://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/create_custom_guest_account

One thing to be aware of is that, if the login window is set to show icons instead of the username and password blanks, all guest accounts created will show up with a Guest User account icon regardless of the account’s name.

If you need to have multiple user accounts, I recommend setting the login window to display username and password blanks and then logging in with the relevant username.