Community plugin
User Accounts
Enumerates local user accounts from the directory services node, recording account metadata without password hashes or keys
system.usersCommunitymacOS 10.12+v1.0.0systemuseraccountsRun this plugin
Trigger collection for User Accounts on its own with the --plugin flag, or include it in a wider sweep by category.
# Just this plugin
macfor collect --plugin system.users --output ./evidence.zip
# Dry run — list what would be collected
macfor collect --plugin system.users --dry-runCompatibility
- macOS 10.12+
Artifacts (1 collected)
Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.
config
| Artifact | Format | Path | Notes |
|---|---|---|---|
Local User Accounts local_accountsRequires root | binary_plist | /private/var/db/dslocal/nodes/Default/users/*.plist | — |