Deleting Unwanted User Profiles from macOS and Windows using JumpCloud

Purpose

Remove unwanted or suspended user profiles on macOS and Windows endpoints directly via JumpCloud Commands, while preserving required users.

Prerequisites

• JumpCloud admin access
• Devices must be Active (commands won’t execute on Inactive machines)
• Username(s) to preserve must be identified before running scripts
• Understand risk: deletion is permanent

Step-by-Step Instructions

Step 1 — Delete unwanted user profiles on macOS

1. Login to JumpCloud Admin Console
2. Go to Commands → + Add New Command
3. Select macOS
4. Paste this script in the Command section
5. (Replace username_to_retain with the user you want to keep enabled)

#!/bin/bash

armed=false

target_user="username_to_retain"

sudo dscl . -delete "/Users/$target_user" AuthenticationAuthority ";DisabledUser;"

IFS=$'\n'
for x in $(dscl . -list /Users); do
    if dscl . -read "/Users/$x/" | grep -q DisabledUser; then
        if [[ ! "$x" =~ "_jumpcloudserviceaccount" ]]; then
            if [[ "$armed" == true ]]; then
                sudo sysadminctl -deleteUser "$x"
            fi
        fi
    fi
done

exit 0

1. Run once with armed=false → confirm output
2. When verified, set armed=true to actually delete disabled users

Step 2 — Delete unwanted user profiles on Windows

1. In JumpCloud → Go to Commands → + Add New Command
2. Check Windows
3. Paste this PowerShell script
4. (Replace "user name" with user(s) to keep)

$usersToKeep = @("user name")

$allUsers = Get-LocalUser

foreach ($user in $allUsers) {
    if ($usersToKeep -notcontains $user.Name) {
        Disable-LocalUser -Name $user.Name
        Remove-LocalUser -Name $user.Name
    }
}

1. Run the command
2. Check Results → verify devices executed scripts successfully

Expected Result / Validation

• macOS and Windows machines only retain the usernames you whitelisted
• All other local users that were disabled or not allowed are deleted
• You see deletion events in JumpCloud Commands → Results

FAQs

Q1. Will this delete JumpCloud-managed accounts as well?

Only if you remove them from the “users to keep” list. Make sure you list the usernames that must remain. The script deletes all others.

Q2. Should I run this directly with delete enabled?

No. Always run first with:

• mac → armed=false
• windows → test with a small batch

Then only switch to “true” mode or allow delete when you are 100% sure.

Q3. Does this work on inactive / offline devices?

No. JumpCloud Commands execute only when the device is online & active.

Q4. What if I want to preserve multiple users?

You can add multiple usernames in the $usersToKeep array (Windows) or change target_user logic (mac). The script supports multiple preserve accounts.