I am following instructions written by someone else to harden an OS X box. One requirement is to made sure certain system-defined groups have no users in them. For this example I will use _ard, but there are quite a few.
Out of the box, the group _ard has one user in it, also named _ard. So I thought I would use dseditgroup to remove that user from the group:
dseditgroup -o edit -u myadminname -p -d _ard -t user _ard
I'm prompted for my password, and everything seems to work fine. No error message is returned, but user _ard is still in group _ard.
dseditgroup -o checkmember -m _ard _ard yes _ard is a member of _ard
I have tried many permutations, including using
-n . and spelling out the full paths to the local groups and users.
As a reality check, I put in gibberish names for the group and for the user. In both cases I got back an error message. So the system is recognizing the group and the user, is not returning an error, but is not performing the operation.
Finally I turned to
dscl to try to accomplish the same thing, also without success. All the permutations I tried based on searches all over the Interwebs, including many permutations of
sudo dscl localhost -delete /Local/Default/Groups/thegroupname GroupMembership theusername
gave the same result - no error, no result.
So - am I killing myself to follow badly-written instructions and it's not possible to remove that user from that group, or am I missing something else?
Any help is greatly appreciated.
Edit to add: Should have mentioned that the GUI will not allow me to remove the users either.