[kgo]

But most of the time, someone using MacOS has physical access to the box. They can always just boot up as single user and BOOM root:

http://support.apple.com/kb/ht1492