Skip to content

November 29, 2017

Here’s How to Temporarily Fix the macOS High Sierra Bug That Gives Full Admin Access to Your Mac Sans Password

by John_A

A newly discovered bug in macOS High Sierra enables the root superuser on a Mac with a blank password and no security check, essentially giving anyone full access to your Mac.

Apple is likely already working on a fix, but in the meantime, there’s a temporary workaround — enabling the root user with a password. Here’s how:

Open System Preferences.
Choose Users & Groups.
Click on the lock to make changes.
Enter your administrator name and password.
Click on “Login Options.”
Choose “Join” at the bottom of the window.
Select “Open Directory Utility.”
Click on the lock to make changes and enter your username and password.
At the top of the menu bar, choose “Edit.”
Select “Enable Root User.”

From there, you can enter a password for the root user account, which prevents it from being accessed with a blank password, which is what the current bug allows to happen.


Disabling the root user account again follows the same steps, but at the “Edit” portion of the process, you’ll select “Disable Root User” to remove the option. Until the bug is fixed, though, you’ll want to leave the root user account intact to prevent it from being accessed without a password.

To further protect your Mac, you can also disable guest accounts, though this is not a necessary step with a root password enabled. Guest accounts can be disabled by going to System Preferences > Users & Groups and choosing “Guest User” after entering your admin password. Disable “Allow guests to log in to this computer.”

Related Roundup: macOS High Sierra
Discuss this article in our forums

MacRumors-All?d=6W8y8wAjSf4 MacRumors-All?d=qj6IDK7rITs

Advertisements
Read more from News

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Note: HTML is allowed. Your email address will never be published.

Subscribe to comments

%d bloggers like this: