Mac Administrator Account: Find, Reset and Change the Admin Password

To find the administrator account on a Mac, open System Settings > Users & Groups: every account marked "Admin" under its name is an administrator. If you forgot the admin password, reset it from another admin account, with your Apple Account at the login window, or from macOS Recovery. To make a user an admin, turn on Allow this user to administer this computer for that account. The steps for each are below.

Find the administrator name on your Mac

1. Open the Apple menu and choose System Settings.
2. Click Users & Groups in the sidebar.
3. Look under each account name. Administrator accounts say "Admin". Standard accounts say "Standard".

The name shown there is the full name. The short account name (the one you type in Terminal) is in the account's info: click the info button next to the user. If you see an admin prompt and don't know which account it wants, any administrator account on the Mac works.

There is no way to read an existing password back out of macOS. If nobody knows it, reset it.

How to reset the admin password on a Mac

Pick the first option that fits. Each one changes the password, it does not reveal the old one.

From another administrator account

1. Sign in to the other admin account.
2. Open System Settings > Users & Groups.
3. Click the info button next to the locked-out user, choose the option to reset the password, then set a new one.

The user's login keychain keeps the old password, so they will see keychain prompts the next time they sign in. See how to fix keychain issues on Mac.

With your Apple Account at the login window

If the account is linked to an Apple Account, enter a wrong password a few times at the login window. macOS offers to reset it with your Apple Account. Follow the prompts and sign in with your Apple Account password. You may be asked to approve the reset on another Apple device.

From macOS Recovery

Use Recovery when there is no other admin account and the Apple Account option does not appear.

• Mac with Apple silicon: shut down, then press and hold the power button until the startup options appear. Choose Options and continue.
• Intel-based Mac: restart and hold Command and R until the Apple logo appears.

In Recovery, choose the forgotten password option when it is offered, or open Utilities > Terminal, type resetpassword and press Return. The Reset Password assistant lets you pick the user and set a new password. Apple documents the exact screens for your macOS version in If you forgot your Mac login password.

If FileVault is on

With FileVault, the Mac asks for a password or the recovery key before it can read the disk. If you forgot the password, you need the FileVault recovery key or the Apple Account you chose when you turned FileVault on. Without either, the data cannot be recovered. Where to find the key: how to find your FileVault recovery key.

How to make a user an admin on a Mac

1. Sign in with an administrator account.
2. Open System Settings > Users & Groups.
3. Click the info button next to the user.
4. Turn on Allow this user to administer this computer.
5. Log the user out and back in.

To take admin rights away, turn the same switch off. A Mac must always keep at least one administrator, so macOS will not let you remove the last one.

From Terminal, an administrator can do the same with dseditgroup:

sudo dseditgroup -o edit -a jsmith -t user admin   # make jsmith an admin
sudo dseditgroup -o edit -d jsmith -t user admin   # make jsmith standard again
dseditgroup -o checkmember -m jsmith admin         # check membership

Change the administrator name

The full name can be changed in the account's info. Changing the short account name also means renaming the home folder, in a set order, from a second admin account. Follow how to change the user name and rename the home folder on Mac.

Admin rights on company Macs

On a Mac the company owns, most people should work as standard users. An admin can install anything, change security settings and add other admins, which is more than daily work needs. The usual setup:

• Users get standard accounts.
• IT keeps a separate managed administrator account, created at enrollment, with a password IT controls.
• Software reaches users through device management, so nobody needs an admin password to install an approved app.
• Admin rights for one person (a developer, for example) are given on purpose, written down and reviewed.

How standard users get software without admin rights is covered in how to allow standard users to install programs on Mac.

Managing this across many devices

Keeping users standard only works if the apps they need still arrive. trio.so deploys apps to enrolled Macs: App Store apps through Apple MDM and uploaded installers, so users never need an admin password for them. See Apple device management.

Related reading: fix keychain issues on Mac and two-factor authentication on a Mac.