It looks like there is no way to prevent a standard user from changing their password. System Preferences is not available in the list of apps to block in ScreenTime.
Is there a way to protect a standard user account from having the password changed in Monterey?
Thanks!
MacBook Pro Apple Silicon
Those types of things can only be set using an MDM Profile.
However, it doesn't appear "cannot change" is an option: Password and passcode MDM payload settings for Apple devices - Apple Support
The goal is to allow "student" users to use one app on the computer.
Ideally, the app should be the only app available in the Dock.
The Mac's configuration should remain constant from the student's perspective.
These setting for the student user help as a work around.
FileVault: OFF (to allow automatic login)
Password: SET (not known to students)
Auto Login: ON for Student
Require password after sleep, etc...: OFF
Require password to change System Prefs: ON
Screen Time down time: 12:01 am to 11:59 pm every day (can't seem to clsoe the gap)
Screen Time: only the target app Always Allowed
This way the password is never required for normal student acces and
users do not know the password to change it in System Prefs.
I can understand there are use cases, but my point was the OS is not set up for that use case at all.You might be able to find some third-party solution that will create some sort of kiosk mode.
I have set up a Linux machine in kiosk mode, but I don’t know if anything like that exists for macOS.
I think at a minimum you’re gonna need an MDM solution, but Apple’s doesn’t seem to meet your requirements though you may be able to lock it down such that it does work, just not in the way you want. There’s also JAMF, and possibly others.
Well, there's the problem. macOS is a multi-user operating system. It is not designed to "share" a single account. There is nothing built into it to facilitate running a single user account for multiple people.
Can you prevent use of System Preferences in the same way you are only allowing access to one program? I have never used Screen Time or any of the previous iterations, so I don't know what is possible.
You may have to find a way to prevent access to the Users & Groups System Preferences.
I don't imagine the path you have taken will yield an acceptable solution.
This is setup allows several Macs to be used a test stations for trainees. There is a parade of new users testing on these machines. It's a fairly well controlled area in a facility that requires some security and the trainees don't have much time to cause any mischief. A few macOS's back the set of restrictions in Parental Controls was more complete (for this particular purpose). The Macs have been upgraded and the Admins would like that same kind of security. Without better protection of more of the System Preferences in standard user accounts, this is a sub-optimal work around, but may be acceptable for this situation.
Preventing Monterey standard user from changing password
