When you enroll devices in Swif and turn on certain features, Swif may create local accounts on those devices. This article lists every account Swif creates, what it's for, whether it has administrator privileges, and how to control it.

Swif doesn't create local accounts on iPhones, iPads, or Android devices.

A local administrator account named swifteam that Swif creates when a device enrolls. Swif uses it for tasks that need administrator rights, such as:

Swif manages the account's password. On Linux, Swif also monitors the password and resets it if it no longer matches the value stored in Swif.

To stop Swif from creating the Swif Admin account on BYOD devices, turn off the Swif Admin User setting in the Swif console's Settings. See Managing BYOD Enrollment for macOS in Swif and Managing the Swif Admin User on Linux.

Policies that set every local account to standard permissions, such as User Account Permission Sync, leave the Swif Admin account as an administrator.

For details, see Swif Admin User Behavior on Managed Devices.

A local service account named wazuh, plus a group with the same name. It's created by the Swif Security agent when you turn on a Device CVE Report Policy for Macs or Linux devices. The account comes from the standard Wazuh agent installer, which the Swif Security agent is built on. It isn't created on Windows.

The part of the agent that communicates with Swif runs as this account, instead of with administrator (root) rights. If that part were ever compromised, an attacker wouldn't get administrator access to the device. This is a common security practice called privilege separation.

Turning off the Device CVE Report Policy, or removing it from a device, uninstalls the Swif Security agent.

Wazuh's documentation confirms this behavior:

The Apple SSH User Policy and the Linux SSH User Policy create the accounts you list in them, so users can sign in over SSH with their public keys. Swif creates an account only if it doesn't already exist on the device.

In Swif: open the device, and go to the Accounts tab. It lists the device's local accounts and their privileges.

On a Mac: run this in Terminal to list local accounts, including hidden ones:

On Linux: run this to check for the Swif accounts:

This is the Swif Admin account. Swif uses it for administrator tasks, such as enforcing policies and resetting passwords. It's expected on managed devices. On macOS and Linux, it's hidden from the login screen.

This is the limited service account the Swif Security agent uses for vulnerability detection. It has no administrator privileges, and no one can log in with it.

This is expected. Turning off the Swif Admin User setting affects only devices that enroll afterward. Accounts on devices that already enrolled stay.

On Debian, Ubuntu, and Arch, this is expected. The account can remain after the agent is uninstalled. Remove it with sudo userdel wazuh, then sudo groupdel wazuh if the group is still there.

On Macs and RPM-based distributions, check that the policy change reached the device and the agent was uninstalled. The account is removed together with the agent.