Detect hidden user accounts

Open Terminal, which is in /Applications/ Utilities. In the app’s window, enter the following command:

sudo defaults write /Library/Preference s/com.apple.loginwindow Hide500Users -bool FALSE

This command should reveal any hidden accounts on the login window. If all seems in order, log back in to your own account, open Terminal as before, and enter the command:

dscacheutil -q user | grep -A3 -B 2 -e uid:\ 5'[0-9][0-9]'

This lists every user account on the Mac. Check the “name” value of any you don’t recognize. The “dir” value tells you the location of an account’s home folder; if one doesn’t start with “/Users” it’s a hidden account. To remove it from your Mac, enter sudo dscl . -delete and then its “dir” value. For example: sudo dscl . -delete /var/hiddenuser

To unhide an account and investigate it further, enter sudo dscl . create and then a space, the account’s “dir” value, another space, then IsHidden 0 – say, sudo dscl . create /var/hiddenuser IsHidden 0