What is opendirectoryd on Mac?

What opendirectoryd does

opendirectoryd (/usr/libexec/opendirectoryd, running as root) is the macOS directory service. It answers:

• who is this user: mapping user IDs to names, home folders and shells
• which groups is this user in: used for file permissions, admin checks and sudo
• is this password correct: logins, unlock, sudo, Keychain unlock, System Settings authentication
• queries against network directories when the Mac is bound to Active Directory or LDAP

Local accounts are stored in /var/db/dslocal. Tools like dscl, id and dscacheutil all talk to opendirectoryd.

Why it uses CPU

• Unreachable network directory: a Mac bound to Active Directory or LDAP off the office network or VPN. Lookups wait for timeouts.
• An app in a lookup loop: a backup tool, antivirus, MDM agent or sync client resolving the same user or group over and over, often while scanning files.
• Very large groups in a corporate directory.
• A corrupted local record after a migration, especially a broken user or group plist.
• Brute-force attempts: repeated failed logins over SSH or Screen Sharing.

How to make it calm down

Check whether the Mac is bound to a directory:

dsconfigad -show
odutil show nodes

If dsconfigad prints a domain, or odutil lists an online LDAP node, and you’re away from the office, connect the VPN and see if CPU drops. (An /Active Directory entry in the list is the built-in plug-in and appears even on unbound Macs.) Ask IT before unbinding a work Mac.

Look at what opendirectoryd is being asked. Turn on statistics, wait a few minutes, then read them:

sudo odutil set statistics on
odutil show statistics

Find recent failures:

/usr/bin/log show --last 10m --process opendirectoryd --style compact | grep -iE 'error|fail|timeout' | tail -30

Repeated lookups for the same name point to the app causing it. Then:

1. Flush the directory cache: sudo dscacheutil -flushcache.
2. Update or reconfigure the app in the loop (often a security or MDM agent).
3. Turn off Remote Login and Screen Sharing in System Settings › General › Sharing if you don’t use them.
4. Restart. If the problem returns, run sudo odutil reset statistics and check statistics again later to see what grows. Turn them off afterwards with sudo odutil set statistics off.

When to worry

The binary is Apple’s and protected:

codesign -dv --verbose=2 /usr/libexec/opendirectoryd 2>&1 | grep -E 'Identifier|Authority'

What matters is why it’s busy. Lots of failed authentication attempts in its log, especially from sshd, mean someone is trying passwords against your Mac. Turn off Remote Login or restrict it to specific users.

Seeing it in Stat Space

Stat Space’s process inspector shows each process’s parent, user, signer and open sockets, which helps when you’re working out which agent is driving opendirectoryd’s lookups. With Pro, Spike Rewind records the top three processes whenever CPU crosses your threshold, so a spike that happens while you’re away is still on record when you’re back.