Suppose I'm using a non-administrator account and I want to run an app (e.g., Terminal) as an administrator. This is easy enough to do in Windows. Can it be done on a Mac?
[Re-Titled by Moderator]
What do you need to run as administrator? You can run pretty much everything as a standard user. If any system-level app needs more privileges, it will ask for them. Then, you can provide your administrator login and password to perform the privileged operation. The same thing happens if you are running as an administrator. The only difference is that if you are already an administrator, the login name is filled-in for you. But you still have to supply the password.
In theory, 3rd party apps can do this too, but they very rarely need to do this. Usually the only time a 3rd party app needs privileges during installation, and it will be the Apple installer that handles it in that case.
There was a time, a couple of years ago, when Apple's Console app required administrator privileges and didn't automatically ask for them. I had to write a little AppleScript to run it with the "with administrator privileges" qualifier. But Apple has since fixed that problem, and broken Console more generally. There's no point in running it anymore as it is so filled with noise.
What do you need to run as administrator? You can run pretty much everything as a standard user. If any system-level app needs more privileges, it will ask for them. Then, you can provide your administrator login and password to perform the privileged operation. The same thing happens if you are running as an administrator. The only difference is that if you are already an administrator, the login name is filled-in for you. But you still have to supply the password.
In theory, 3rd party apps can do this too, but they very rarely need to do this. Usually the only time a 3rd party app needs privileges during installation, and it will be the Apple installer that handles it in that case.
There was a time, a couple of years ago, when Apple's Console app required administrator privileges and didn't automatically ask for them. I had to write a little AppleScript to run it with the "with administrator privileges" qualifier. But Apple has since fixed that problem, and broken Console more generally. There's no point in running it anymore as it is so filled with noise.
As MrHoffman has implied, do not enable the root account for login.
Script kiddies on the internet are constantly knocking on any internet connected device attempting to guess the root password.
The disabled by default macOS root account cannot be accessed by these script kiddies.
If you need root access (the equivalent of Windows Admin access), then use the sudo command.
I write commercial Linux software for a Fortune 100 company, and every one of hosted Linux development and test systems i use have the root account disabled for login. The same is true for my personal and work Mac computers.
When I need root access (and i do several times a day), I use the sudo command.
The privilege boundaries are handled very differently between macOS and Windows.
I wouldn’t usually recommend running a random app as an administrator. Not an app that didn’t already expect to run privileged, that is. That in macOS or Windows.
Within Terminal (whether admin or not), you can issue admin commands using sudo [command] and su:
Enter administrator commands in Terminal on Mac - Apple Support
There are mechanisms available to properly handle the privilege boundary too, depending on what you’re working on.
For both accountability and security reasons, I usually don’t suggest enabling root, but that suggestion can arise in this context:
How to enable the root user or change the root password on Mac - Apple Support
Luis Sequeira1 wrote:
You can't use sudo from a standard account - you get an ominous "this incident will be reported".
But, even from a standard account you can do as I described above:
first use "su" with the administrator account name, e.g. "su admin"
and then you can use sudo.
To add, you can add any user to the sudoers file, but I would just su to an admin because adding them to sudoers bypasses the only reason you would bother with a standard user account.
Unix is secure out of the box. Windows has to be made secure. It is completely opposite from the unix way.
LuigiBenetton wrote:
Thanks for the replies.
I may not be explaining myself clearly. I usually use my Mac in a regular user account (i.e., not one with admin privileges). Windows lets you right-click an all and "run as administrator" (or words to that effect). I thought it would be easy enough to do the same on a Mac, but it seems like the barriers are higher here. Oh well.
Applying existing knowledge of Windows to other platforms too often ends in confusion or frustration.
Without making any references to Windows, Windows features, or Windows implementation details, what task are you trying to do? Please describe the problem or limit or issue here, and preferably without referring to any Windows approaches or solutions to addressing that problem or limit (on Windows).
If you want to access stuff for another user within Terminal for instance, that is usually with su or sudo commands. Use of su snd sudo is longstanding UNIX practice.
Other GUI apps will prompt for admin credentials for protected accesses, where appropriate.
If you really need to access the context of another user, set up Fast User Switching:
If you want to access protected parts of macOS itself, that access is blocked for all. Including admin. (Signed security volume, system integrity protection, etc.)
You can't use sudo from a standard account - you get an ominous "this incident will be reported".
But, even from a standard account you can do as I described above:
first use "su" with the administrator account name, e.g. "su admin"
and then you can use sudo.
LuigiBenetton wrote:
Thanks for the replies.
I may not be explaining myself clearly. I usually use my Mac in a regular user account (i.e., not one with admin privileges).
That usually only protects you from yourself, but you are attempting to bypass that protection.
A Standard user cannot elevate their privileges. As MrHoffman noted, you may be able to su to an admin user, then sudo in that account.
FWIW (and I know a lot of people disagree with me), I think you should just let your day-to-day user account in your mac be and administrator account, and just use sudo when necessary in Terminal.
But if you still want to work from a standard account, you have to do (substitute the correct account name for "admin" below)
su admin
(enter admin password as requested)
sudo ...
(enter admin password if requested)
If you need to run a shell as admin, you can do
sudo zsh
As long as you know the admin password (when prompted), it should work from a non-admin account.
Thanks for the replies.
I may not be explaining myself clearly. I usually use my Mac in a regular user account (i.e., not one with admin privileges). Windows lets you right-click an all and "run as administrator" (or words to that effect). I thought it would be easy enough to do the same on a Mac, but it seems like the barriers are higher here. Oh well.
I do use fast user switching.
Based on the comments made here, I guess I'm applying a Windows method of doing something to the Mac when I don't actually need it. Good catch, MrHoffman.
sudo should do the job within Terminal. Can't think of another app I would need to do this for, so I guess we can close this thread.
(This did not seem to work, for some reason, when I tried to run Terminal from a standard user account as an administrator. I was trying to fix something that got messed up when administrators at work changed a setting on a server to point me to a new, faster server that now contains my work environment. The problem has since been fixed, thanks to patient persistence on the part of one of the IT reps.)
IT admin can block shenanigans. Or can cause them. Whether with file shares, or Fibre Channel, or otherwise.
Present-day Windows is descended from MICA, and shares ~no lineage with UNIX or Linux. Not outside of WSL and WSL2. Best not to try mapping how Windows works to any other platforms either, with one or two exceptions now only rarely encountered.
Is it possible to run an application as an administrator on macOS Sonoma?
