Remove Admin Rights

Question

Level 1

9 points

Remove Admin Rights

I recently bought a Mac and set up my daughter as the default account. Now I realize I should have set up an Admin account and then set my daughter up as a regular user so I can use parental controls. I set up am Admin account for me but can't seem to remove my daughter's Admin rights through the usual account settings. Any advice? Maybe there's some tricky way to do this using the root account?

If all that fails, is there an easy way to copy all her stuff intact into a newly created account?

Thanks

MacBook, Mac OS X (10.0.x)

Posted on Mar 30, 2011 1:17 PM

Reply

Answer 1

Király

Level 6

10,025 points

Mar 31, 2011 12:14 PM in response to m-d-c

I have seen this before. It seems to be a bug.

Try logging in to the new admin account, and entering the following in Terminal (where "daughter" is your daughter's account short name.) It should remove your daughter's account from the admin group.

sudo dscl . -delete /Groups/admin GroupMembership daughter

enter the new admin account's password when prompted, and press return.

Reply

Answer 2

m-d-c Author

Level 1

9 points

Mar 30, 2011 4:25 PM in response to Kappy

Thanks for the response, but the option is grayed out. Tried when logged into my Admin acct and my daughter's Admin acct. This is a fresh install of OS, so I don't think there's a problem with the system.

Am I missing something obvious? Any other suggestions?

Thanks for your help.

Reply

Answer 3

Kappy

Level 10

362,007 points

Mar 30, 2011 1:50 PM in response to m-d-c

Open Accounts preferences when logged into your admin account. Click on the lock icon and authenticate. Select the other account and uncheck the box labeled, "Allow user to administer this computer." Check the other box labeled, "Enable Parental Controls." Click on the Parental Controls button to configure.

Reply

Answer 4

captfred

Level 7

26,446 points

Mar 30, 2011 2:09 PM in response to Kappy

I believe that option will be grayed out unless he's logged into his daughter's admin account. (I didn't know that but just tried it).

Then log into the New admin account and set parental controls for the daughter's account.

Reply

Answer 5

varjak paw

Level 10

182,662 points

Mar 30, 2011 2:25 PM in response to captfred

No, unless something's amiss with the system, if m-d-c has an account with administrator rights, then as long as s/he's logged into that administrator account, s/he can remove the admin rights for any other account. I do that quite regularly, for various reasons. If it's not working for you, make sure you've unlocked the preference.

Regards.

Reply

Answer 6

m-d-c Author

Level 1

9 points

Mar 30, 2011 7:08 PM in response to jsd2

No luck when she is logged out.

I noticed that I can change Admin rights on my acct when I am logged in as my daughter but can't change rights on her acct when I am logged in as me.

Perhaps her acct has some "super" privileges? Is she maybe set up as the root acct?

Any ideas how I can figure this out?

Thanks

Michael

Reply

Answer 7

m-d-c Author

Level 1

9 points

Mar 31, 2011 6:17 AM in response to Kappy

Yes, I clicked lock icon and authenticated.

Is it possible that my daughter's account has some sort of "super" privileges and cannot have its Admin rights removed? Is there any way to see whether she is set up as the root user?

Thanks for your help

Michael

Reply

Answer 8

Kappy

Level 10

362,007 points

Mar 31, 2011 9:25 AM in response to m-d-c

No. All admin accounts are the same. Sounds like if you've done what's been suggested, then your system may be corrupted in some way. If it is then you will need to reinstall Snow Leopard.

Reinstalling Snow Leopard

Boot from your Snow Leopard Installer disc. After the installer loads select your language and click on the Continue button. When the menu bar appears select Disk Utility from the Utilities menu. After DU loads select your hard drive entry (mfgr.'s ID and drive size) from the the left side list. In the DU status area you will see an entry for the S.M.A.R.T. status of the hard drive. If it does not say "Verified" then the hard drive is failing or failed. (SMART status is not reported on external Firewire or USB drives.) If the drive is "Verified" then select your OS X volume from the list on the left (sub-entry below the drive entry,) click on the First Aid tab, then click on the Repair Disk button. If DU reports any errors that have been fixed, then re-run Repair Disk until no errors are reported. If no errors are reported click on the Repair Permissions button. Wait until the operation completes, then quit DU and return to the installer.

Reinstall OS X: Snow Leopard's installer will not erase your hard drive and will preserve all your data, users, network preferences, and third-party applications and their support files.

If DU reports errors it cannot fix, then you will need Disk Warrior and/or Tech Tool Pro to repair the drive. If you don't have either of them or if neither of them can fix the drive, then you will need to reformat the drive and reinstall OS X.

Reply

Answer 9

m-d-c Author

Level 1

9 points

Apr 2, 2011 9:19 AM in response to Király

Still did not work.

I ran the disk repair and reinstalled the OS and tried your suggested terminal command. I get the following error message:
<MAIN> eDSAttributeNotFound
<dscl_cmd> DS ERROR: -14134 (eDSAttributeNotFound)

I also noticed something. Not sure whether it tells you anything... When I look at the user directories on the harddrive, mine is shown as "Michael". My daughter's user directory is called "Admin$".

Was her account set up in some way that it cannot have admin rights removed?

Thanks

Michael

Reply

Answer 10

Kappy

Level 10

362,007 points

Apr 2, 2011 9:45 AM in response to m-d-c

Oh, that's a problem. You cannot use the "$" character in a username. It's a special character used as a wildcard in Unix. Also, I've found that sometimes Unix objects to using "admin" as a username since that is also used as a group name.

I suggest you boot into your account and delete that account. Create a new account for your daughter and this time use a normal username like you have for your account.

Reply

Answer 11

Király

Level 6

10,025 points

Apr 2, 2011 10:39 AM in response to Kappy

"admin" can be used as a username; the only admin account on my Mac has exactly that user name.

But if one chooses to use "admin" as a username, it can only be an admin account. It's not possible to remove the "admin" user from the admin group. OS X warns about this if one tries to create a new user with the name "admin".

I agree with Kappy. Delete the account and make a new one.

Reply

Answer 12

Apr 20, 2012 3:57 PM in response to m-d-c

I have exactly the same problem, but it's with my own account.

I set up both my wife and myself as administrators when we first started the machine, since I was still obtaining and installing software for each of us. My own account was the first one I set up.

I have done a lot of work importing all our files from PC, and setting up our accounts how we want them, so I really don't want to delete the accounts and start over.

I recently decided that for day-to-day use, we shouldn't use admin accounts, so I removed the admin rights from my wife's account, which worked fine, but I am unable to remove them from my own account. The option is greyed out whether I log in as myself, or as the "root" user. I have never been logged in to the account when trying to remove admin rights from it.

Any tips greatly appreciated!

Reply

Answer 13

Apr 21, 2012 2:50 AM in response to Maeonides

You have to have at least one admin account; that's why it won't let you remove admin privileges from yours.

Create a new account, make it an admin, log into it and then remove the admin status from your own account.

Log out and back in to your own account. If you try to do anything requiring admin privileges, you'll be presented with an authentication dialogue in which you should enter the details and password for the new admin account.

Reply

Answer 14

Apr 22, 2012 1:49 AM in response to Maeonides

I'm not sure if you can, but it's potentially dangerous anyway.

You can only enable and disable Root from another admin account.

Root would have to be enabled at all times or you're left with no way to administer.

Entering Root as the only admin password in a dialogue box presented by malware would leave your entire system wide open.

Not to mention the potential system damage that can be done moving the wrong files in System Library with Root privileges.

All in all, may be possible, but definitely not a good idea.

Reply

Answer 15

Király

Level 6

10,025 points

Apr 22, 2012 9:52 AM in response to noondaywitch

At least one admin account is required; The root account can't be used for it.

PS it is possible to enable/disable the root account while logged in to a non-admin account, simply by authenticating with an admin's username and password when prompted.

Reply