What is the best practice for installing new software on a Mac?

Question

Level 2

159 points

What is the best practice for installing new software on a Mac?

On one hand, it seems like it should ideally be the Admin's role to install new software for all users.

However from a security standpoint, if the admin is used to install new apps, and the installer includes malware, the installer app could have full access to make changes throughout the entire system.

Looking deeper, Apple ID issues seem to raise additional complications:

If an app is obtained from the Mac App Store, you have to sign in with a user's Apple ID in order to download it. Is this an App Store requirement, or is the requirement emanating from your Mac? If the app is obtained from another source, do you still have to sign in with an Apple ID to install it?

If your Mac has more than one user, ie,

Tom (standard user with his own Apple ID)

Susie (standard user with her own Apple ID)

admin (unrestricted user: whose Apple ID? Why?)

...should each user install his/her own apps under their own IDs? Or could Tom (with helpful intentions) log in as Susie but sign into AppStore with his AppleID and install an app for Susie? What happens if he does this?

Or, if Tom goes to App Store and uses HIS AppleID to download an app, will that app only run when Tom is logged into the computer under his Tom account, or do all users gain access to that app?

Finally, if you use the admin account for all app installations, what Apple ID should be used when logged in as admin for that purpose... and why?

Mac mini, macOS 12.1

Posted on Jan 25, 2022 7:59 AM

Reply

Answer 1

Top-ranking reply

autochthon Author

Level 2

159 points

Jan 25, 2022 2:19 PM in response to PRP_53

Thanks for explaining about "Sealed And Read Only Volumes" - that is quite reassuring. Also, I do exercise due diligence and with very rare exceptions always acquire Mac and iOS from the App Store only…but thanks for pointing that out.

Reply

Answer 2

PRP_53

Level 10

91,411 points

Jan 25, 2022 8:36 AM in response to autochthon

" However from a security standpoint, if the admin is used to install new apps, and the installer includes malware, the installer app could have full access to make changes throughout the entire system. "

The worse the malware could do is Infect the user account from which it was installed from.

After all, Big Sur and Monterey reside in a " Sealed And Read Only Volume" and can not be changed or altered except by Apple Sealed Key Protection (SKP)

If the Admin is used to install applications and Malware or Adware is included in the software - the Admin User IMHO is doing less than the due diligence in sourcing software directly from Known and Trusted Developers or sources.

Reply

Answer 3

Jan 25, 2022 8:33 AM in response to autochthon

You are making things a lot more complicated than they need to be.

Say two people use the same mac.

Each has his/her own account, say User A and User B.

If you are concerned about using an administrator account all the time, just make it so that User A and User B are standard accounts, and have an Admin account. Whenever something that requires administrator privileges, users will be asked to supply the administrator credentials.

Concerning applications installed from the App Store: you purchase them (or "get" them, if they are free), and the purchase is associated to an Apple Id. That only matters when you need to redownload or update the application.

Once the application is installed on your mac, it is available for all users of that mac, and there is no Apple id involved in using it.

Reply

Answer 4

autochthon Author

Level 2

159 points

Jan 25, 2022 2:11 PM in response to Luis Sequeira1

Thanks, Luis - You are right; I’ve always been good at making things more complicated than they need to be! 😉

I always do, as you advised, limit the two daily users to standard user privileges. Having the ability for them to OK app installations by entering the admin’s username & password, is a nice convenience; i guess because i also have a Windows PC, I may be unduly cautious about Mac app installation/user privilege issues.

Thanks for explaining about how AppleIDs factor into app installations and accessibility.

Reply