recovery deleted wheel

YurichGu · 12-19-2012, 04:27 AM

Hi Everyone

OS X 10.8.2
I have just deleted wheel group by accident.

Can You give me a hint how to recovery it....

hayne · 12-19-2012, 05:11 AM

1) The best way would be to restore your system to the most recent backup.

2) To add a group, the method depends on precisely which version of OS X you have.
On 10.8, start by reading 'man 8 opendirectoryd'

How exactly did you delete the 'wheel' group "by accident"?

YurichGu · 12-19-2012, 05:26 AM

Quote:

Originally Posted by hayne


	1) The best way would be to restore your system to the most recent backup. 2) To add a group, the method depends on precisely which version of OS X you have. On 10.8, start by reading 'man 8 opendirectoryd' How exactly did you delete the 'wheel' group "by accident"?

Hi Hayne

thank You for the reply.

unfortunately, i don't have any backups.
i was trying to delete users from the group, but the whole group was deleted.
( "sudo dseditgroup -o delete -a yurich -t user wheel" and thats all)

to be honest, I don't follow how i can recover wheel utilising dscl.
could You be so kind to give me a hint ?

I bumped into the manual how to recreate wheel using /var/db/netinfo/local.nidb
will it be applicable to my case ?

benwiggy · 12-19-2012, 06:09 AM

This will sounds harsh, but:
1. There is no reason to go messing about with these areas of the OS unless you have a much better grasp of it than you seem to have. Why were you trying to remove users from the group "wheel" in the Terminal in this way? I certainly wouldn't attempt it.

2. Everyone, no matter what their ability, should have a backup of their system disk, especially before hacking it.

Your simplest course of action is to reinstall the OS. It shouldn't take long.

agentx · 12-19-2012, 06:10 AM

NO everything is stored in OpenDirectory not netinfo db !

This may work but a reinstall which should retain all your data is more than likely the best course of action.

start computer in single user mode
Mount the filesystem

Code:

/sbin/mount -uw /

Start opendirectory

Code:

launchctl load /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist

now this is a bit that might need work as i have never tried to create wheel before !

Code:

dseditgroup create -n /Local/Default -n "System Group" wheel

after this you would want to use below to check that root is part of group and you may need to set the PrimaryGroupID

Code:

dseditgroup -o read wheel

here is the info from my machine

Code:

sAttrTypeStandard:GeneratedUID -
		ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000
dsAttrTypeStandard:RecordName -
		wheel
dsAttrTypeStandard:AppleMetaNodeLocation -
		/Local/Default
dsAttrTypeStandard:GroupMembers -
		FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000000
dsAttrTypeStandard:PrimaryGroupID -
		0
dsAttrTypeStandard:RealName -
		System Group
dsAttrTypeStandard:Password -
		*
dsAttrTypeStandard:GroupMembership -
		root
dsAttrTypeStandard:RecordType -
		dsRecTypeStandard:Groups

These hints may help you
http://krypted.com/mac-os-x/create-groups-using-dscl/
http://krypted.com/mac-os-x/more-gro...h-dseditgroup/

YurichGu · 12-19-2012, 08:16 AM

Quote:

Originally Posted by agentx


	Code: dseditgroup create -n /Local/Default -n "System Group" wheel

I have not rebooted yet, but I don't see /Local/Default at the drive.

can it be seen in single mode only ?

agentx · 12-19-2012, 08:41 AM

what you are looking for ? ......The Folder on the Hard Disk ?

/private/var/db/dslocal/nodes/Default is its location......but you should NOT mess with it !

YurichGu · 12-19-2012, 09:11 AM

it seems the group has not been completely removed.

i executed the command "dscacheutil -q group -a name wheel"
and saw the following output:
name:
password:
gid: 0

may be it's just cached info
is it possible to recovery it ?

DeltaMac · 12-19-2012, 09:43 AM

This is a good fix!

Quote:

Originally Posted by benwiggy


	... Your simplest course of action is to reinstall the OS. It shouldn't take long.

Do you need help with that?

agentx · 12-19-2012, 10:18 AM

What is the output from dseditgroup -o read wheel ?
It's forked ;-)

dscacheutil -q group -a name wheel
name: wheel
password: *
gid: 0
users: root

YurichGu · 12-19-2012, 03:14 PM

it seems this solution doesn't work.

i boot into single mode end executed the following:

Code:

/sbin/mount -uw /

launchctl load /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist

dseditgroup create -n /Local/Default -n "System Group" wheel

after the last command i see the following warning:
"failed to obtain a mode reference"

any ideas ?

acme.mail.order · 12-19-2012, 06:38 PM

Quote:

Originally Posted by YurichGu


	any ideas ?

Yes. As mentioned in #4 above:

Quote:

Originally Posted by benwiggy


	Your simplest course of action is to reinstall the OS. It shouldn't take long.

YurichGu · 12-19-2012, 11:47 PM

Quote:

Originally Posted by acme.mail.order


	Yes. As mentioned in #4 above:

unfortunately, it's not a solution for me.

this macbook is a corporate device and i can't reinstall it freely.

hayne · 12-20-2012, 02:24 AM

Quote:

Originally Posted by YurichGu


	unfortunately, it's not a solution for me. this macbook is a corporate device and i can't reinstall it freely.

If this MacBook belongs to your company, you should take it back to whoever is in charge of corporate computers and tell them that you screwed up - and that you need it to be re-imaged (reinstalled with corporate settings etc).

YurichGu · 12-20-2012, 02:36 AM

Quote:

Originally Posted by hayne


	If this MacBook belongs to your company, you should take it back to whoever is in charge of corporate computers and tell them that you screwed up - and that you need it to be re-imaged (reinstalled with corporate settings etc).

I care, that in this case i will loose all materials on the laptop

actually, at the moment i have been utilising this laptop and do not notice any problems caused by the absence of wheel.

what can degrade because of the lack of wheel ?

hayne · 12-20-2012, 03:00 AM

Umm, you should make a backup (or two) immediately if you haven't done so already.
Once you have a backup, there's no issue about possibly losing something.

agentx · 12-20-2012, 03:24 AM

oops typo need -r for real name :-)
Please note not tested !

Code:

dseditgroup create -n /Local/Default -r "System Group" wheel

YurichGu · 12-20-2012, 03:41 AM

Quote:

Originally Posted by agentx


	oops typo need -r for real name :-) Please note not tested ! Code: dseditgroup create -n /Local/Default -r "System Group" wheel

i know about the -r
i tried the command with it

agentx · 12-20-2012, 03:49 AM

I presume you have not restarted yet so you do have access to computer and admin privileges ?

What you can do is open Directory Utility.app and Directory Editor and try and manually rebuild the System Group....again never done this with wheel !

acme.mail.order · 12-20-2012, 06:48 AM

Quote:

Originally Posted by YurichGu


	I care, that in this case i will loose all materials on the laptop

No, you won't. Plug in an external drive / USB memory, copy. Take computer to IT department. Problem solved.

You appear to want to do anything except the simplest, most reliable solution.

12-19-2012, 04:27 AM	#1
YurichGu Prospect Join Date: Dec 2012 Posts: 12	recovery deleted wheel Hi Everyone OS X 10.8.2 I have just deleted wheel group by accident. Can You give me a hint how to recovery it.... Last edited by YurichGu; 12-19-2012 at 05:06 AM.

12-19-2012, 05:11 AM	#2
hayne Site Admin Join Date: Jan 2002 Location: Montreal Posts: 31,956	1) The best way would be to restore your system to the most recent backup. 2) To add a group, the method depends on precisely which version of OS X you have. On 10.8, start by reading 'man 8 opendirectoryd' How exactly did you delete the 'wheel' group "by accident"? __________________ hayne.net/macosx.html

12-19-2012, 06:10 AM	#5
agentx Hall of Famer Join Date: Feb 2003 Location: Brighton, UK Posts: 3,832	NO everything is stored in OpenDirectory not netinfo db ! This may work but a reinstall which should retain all your data is more than likely the best course of action. start computer in single user mode Mount the filesystem Code: /sbin/mount -uw / Start opendirectory Code: launchctl load /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist now this is a bit that might need work as i have never tried to create wheel before ! Code: dseditgroup create -n /Local/Default -n "System Group" wheel after this you would want to use below to check that root is part of group and you may need to set the PrimaryGroupID Code: dseditgroup -o read wheel here is the info from my machine Code: sAttrTypeStandard:GeneratedUID - ABCDEFAB-CDEF-ABCD-EFAB-CDEF00000000 dsAttrTypeStandard:RecordName - wheel dsAttrTypeStandard:AppleMetaNodeLocation - /Local/Default dsAttrTypeStandard:GroupMembers - FFFFEEEE-DDDD-CCCC-BBBB-AAAA00000000 dsAttrTypeStandard:PrimaryGroupID - 0 dsAttrTypeStandard:RealName - System Group dsAttrTypeStandard:Password - * dsAttrTypeStandard:GroupMembership - root dsAttrTypeStandard:RecordType - dsRecTypeStandard:Groups These hints may help you http://krypted.com/mac-os-x/create-groups-using-dscl/ http://krypted.com/mac-os-x/more-gro...h-dseditgroup/ Last edited by agentx; 12-19-2012 at 06:14 AM.

12-19-2012, 10:18 AM	#10
agentx Hall of Famer Join Date: Feb 2003 Location: Brighton, UK Posts: 3,832	What is the output from dseditgroup -o read wheel ? It's forked ;-) dscacheutil -q group -a name wheel name: wheel password: * gid: 0 users: root Last edited by agentx; 12-19-2012 at 10:20 AM.

12-19-2012, 03:14 PM	#11
YurichGu Prospect Join Date: Dec 2012 Posts: 12	it seems this solution doesn't work. i boot into single mode end executed the following: Code: /sbin/mount -uw / launchctl load /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist dseditgroup create -n /Local/Default -n "System Group" wheel after the last command i see the following warning: "failed to obtain a mode reference" any ideas ?

12-19-2012, 06:09 AM	#4
benwiggy League Commissioner Join Date: Aug 2006 Posts: 5,070	This will sounds harsh, but: 1. There is no reason to go messing about with these areas of the OS unless you have a much better grasp of it than you seem to have. Why were you trying to remove users from the group "wheel" in the Terminal in this way? I certainly wouldn't attempt it. 2. Everyone, no matter what their ability, should have a backup of their system disk, especially before hacking it. Your simplest course of action is to reinstall the OS. It shouldn't take long.

12-19-2012, 08:41 AM	#7
agentx Hall of Famer Join Date: Feb 2003 Location: Brighton, UK Posts: 3,832	what you are looking for ? ......The Folder on the Hard Disk ? /private/var/db/dslocal/nodes/Default is its location......but you should NOT mess with it !

12-19-2012, 09:11 AM	#8
YurichGu Prospect Join Date: Dec 2012 Posts: 12	it seems the group has not been completely removed. i executed the command "dscacheutil -q group -a name wheel" and saw the following output: name: password: gid: 0 may be it's just cached info is it possible to recovery it ?

12-20-2012, 03:00 AM	#16
hayne Site Admin Join Date: Jan 2002 Location: Montreal Posts: 31,956	Umm, you should make a backup (or two) immediately if you haven't done so already. Once you have a backup, there's no issue about possibly losing something. __________________ hayne.net/macosx.html

12-20-2012, 03:24 AM	#17
agentx Hall of Famer Join Date: Feb 2003 Location: Brighton, UK Posts: 3,832	oops typo need -r for real name :-) Please note not tested ! Code: dseditgroup create -n /Local/Default -r "System Group" wheel

12-20-2012, 03:49 AM	#19
agentx Hall of Famer Join Date: Feb 2003 Location: Brighton, UK Posts: 3,832	I presume you have not restarted yet so you do have access to computer and admin privileges ? What you can do is open Directory Utility.app and Directory Editor and try and manually rebuild the System Group....again never done this with wheel ! Attached Thumbnails

Thread Tools
Show Printable Version Email this Page
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread: