Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have added a network Group ("workgroup") to our local mac computers' "admin" group, so network users can admin local macs with the following command.

dseditgroup -o edit -u localadmin -P -a workgroup -t group admin

However, I have binded the local macs to a new OD server. I successfully added the new network-admin group to the local group, but I want to get rid of the old one. I can't seem to do this with - it only deletes the "workgroup" of the newly joined OD server, not the old one.

dseditgroup -o edit -u localadmin -P pass -d workgroup -t group admin

Do I have to rejoin the old server to get rid of this workgroup entry? If I leave it, and shut off the old OD server, will this cause any issues/errors on the clients?

share|improve this question

If you unbound the clients from the old OD server, having a leftover entry in the local admin group shouldn't cause any significant problems. But if you want to clean it up, you'll need to do it with the old group's GeneratedUID (aka GUID aka UUID) rather than its name. If you still have the old server, you can look it up there' otherwise you'll have to find it by a process of elimination. First, read the properties of the local admin group with dscl:

$ dscl . -read /Groups/admin
AppleMetaNodeLocation: /Local/Default
GroupMembers: FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000000 1D323FC9-8FBE-4DE7-90C0-8BB50E62429C
GroupMembership: root gordon
NestedGroups: B3060C2C-92F4-4003-AC40-F2AEF9008670 F09152B4-7FE7-4509-9886-18141F4F598F
Password: *
PrimaryGroupID: 80
RealName: Administrators
RecordName: admin BUILTIN\Administrators
RecordType: dsRecTypeStandard:Groups
SMBSID: S-1-5-32-544

The only property you really care about here is NestedGroups -- those are the GeneratedUIDs of the groups that're nested in the local admin group. If you're going by elimination, you'll have to look them up like this:

$ dscl /Search -search /Groups GeneratedUID B3060C2C-92F4-4003-AC40-F2AEF9008670
$ dscl /Search -search /Groups GeneratedUID F09152B4-7FE7-4509-9886-18141F4F598F
Workgroup       GeneratedUID = (

In this example, the first GeneratedUID didn't match any currently visible group, while the second one did; so the first one is almost certainly the leftover.

Once you've found the GeneratedUID of the old group, you can use dscl to remove it:

$ sudo dscl  . -delete /Groups/admin NestedGroups B3060C2C-92F4-4003-AC40-F2AEF9008670

BE VERY CAREFUL WITH THAT COMMAND. If you get it a bit wrong, it could have disastrous consequences (e.g. if you hit return after "/Groups/admin", it would delete the entire local admin group). If you're not comfortable with that, you can do the same thing in Directory Utility's Directory Editor. (Directory Utility is kinda hidden; it's in /System/Library/CoreServices/Directory

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.