In Tiger and below you used NetInfo Manager to enable and disable the root account in Mac OS X. However, in Leopard and above you use the Directory Utility. But you can also use the command line. In /usr/sbin there is a handy little tool called dsenableroot. To use it, simply open up Terminal.app and type dsenableroot. It will then prompt you for your password. Provided you type that correctly it will then prompt you for the password you desire the root account to have twice. Assuming the target passwords match, at this point you should see something similar to the following in your secure.log file:
Apr 6 09:38 client162 com.apple.SecurityServer[22]: checkpw() succeeded, creating credential for user root
There are other options you can use with the dsenableroot command. The -u, -p and -r flags can be used to put the username, password and root password into the command, so that it is not interactive. For example, the following would set the root password on a machine to TANSTAAFL! and use the username of Mike with a password of WyomingKnott:
dsenableroot -u Mike -p WyomingKnott -r TANSTAAFL!
The dsenableroot command can also disable the root account. To do so, simply use the -d flag. This can be done interactively with just dsenableroot followed by -d. It can also be done as in the above example in a non-interactive manner (useful for scripting or sending via ARD):
dsenableroot -d -u Mike -p WyomingKnott
You can also use dsenableroot to change the password of the root account, or stick with the passwd command for that.
There is an undocumented option with dsenableroot, but it’s simply a very unexciting way to get a version:
dsenableroot -appleversion
Which should spit out a comma delimited output (well, almost) that can be used to (for example), verify that the dsenableroot command hasn’t been tampered with (although a checksum might be better for something like that):
dsenableroot, Apple Computer, Inc., Version 112
