Running Commands as Users on a macOS Device

The Addigy Agent runs as the root user on every device, so scripts deployed through Devices or Policies run in that root context by default. When a script needs to read or write user-level files or preferences, you'll need to run it as a specific user instead — that's what the user-job utility is for.

Overview

Addigy provides a simple command-line utility for executing scripts as a particular user:

/Library/Addigy/user-job

Usage

Run the command without any flags to see its usage instructions:

/Library/Addigy/user-job
  -all
      Runs the job as all users for this device.
  -continue-on-error
      Continues running the command on all users even if one fails. Error will be printed to console. Must be used with --all flag.
  -run
      Runs a user job. Must be used with the flag --all or --user.
  -user string
      Runs the job as the specified user.
  -v  Prints the current version.

To use it in a script, add the -user flag followed by the target username, and the -run flag followed by the command to execute.

Note: user-job runs from the target user's home directory, so any file paths referenced in the job script should be absolute.

Example: Running a Command for a Specific User

This combines user-job with defaults write to change a user-level setting:

/Library/Addigy/user-job -user kurtrussell -run defaults write com.apple.user-level-preference some-setting

Example: Running a Command for the Currently Logged-In User

Combine user-job with a snippet that grabs the current console user to write a generic script that works regardless of who's logged in:

#!/bin/bash

loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' )
/Library/Addigy/user-job -user "$loggedInUser" -run defaults write com.apple.some-user-settings another-setting

The first line stores the currently logged-in user's account into the loggedInUser variable, using a technique from MacAdmin Erik Berglund's article Script Tip: Get the currently logged in user, in Bash. Inserting that variable into the user-job command lets you change a setting across an entire policy or organization without knowing usernames in advance.

Example: Running a Command for All Users, Including Those Not Logged In

Add the -all and -continue-on-error flags to generalize the script even further:

/Library/Addigy/user-job -all -continue-on-error defaults write com.apple.finder CreateDesktop -bool FALSE
killall -HUP Finder

This example disables desktop icons for every user account on the device — a simple demonstration of what user-job can do at scale.

Frequently Asked Questions

Why can't I just run "defaults write" directly in my script?

Because the Addigy Agent — and any script it runs — executes as root. User-level preferences need to be written in that specific user's context, which is what user-job provides.

Do file paths need to be absolute in a user-job script?

Yes. Since the job runs from the target user's home directory, use absolute paths for any files you reference.

Can I target users who aren't currently logged in?

Yes — use the -all flag together with -continue-on-error to run the job across every user account on the device.