Standard user account or Admin account on a daily basis?

(*Aria*) wrote:

When you surf do you use a Standard or Admin user account?

I was told it's safer to use a Standard user account. Can I convert my Admin user to Standard, then switch it to Admin when I install software & software updates? Or am I locked in to one type of user for the life of the account? I believe the only time I need an Admin account is when I do install software, correct? What other limitations are they in using a Standard account on a daily basis?

Create another Admin user, log out of your first user and into the new Admin user, turn your first user Admin to General user.

When you have to install OS X updates, programs and alter certain folders it will need your Admin name and password.

It does afford another level of protection.

Other than that, it doesn't affect anything and is quite comfortable to deal with.

If your always doing something in Admin, like deleteing a bunch of programs like I had to do today (oh rare is that?), then simply log into it so you don't have to constanlty enter the Admin name and password for every file oyur dragging out of hte Applicaitons folder ot the trash.

Protecting the Applications folder is important, any changes in there to programs could be used against you if it requires your password to run.

I guess what I don't understand is why it is different because in your admin account don't you also have to use your admin name and give your password to install a program?

laverne's mom wrote:

I guess what I don't understand is why it is different because in your admin account don't you also have to use your admin name and give your password to install a program?

OS X has four levels of "privileges"

Guest - nothing - deleted when finished

General User - just user files changes - no program installs

Admin User - almost all access - program install (drag and drop) - limited root user access (system wide installs) with sudo

Root User - turned off by default - ultimate and complete access to everything.

When you enter the Admin Username and Password, a Unix/Linux "sudo window" is created allowing temporary access to Root user privileges. It is closed after a time period. Sudo stands for "Super User Do" which "Super User is another name for the Root User.

To enable full Root user all the time, there is a special OS X procedure for doing so. Developers and programmers use it as it's too much trouble to be always using the sudo window to access root level files.

So the dangerous levels to be running while surfing the internet is Admin and especially Root user.

If a malicious program manages to run while your in Admin, it can write itself to the Applications folder perhaps do other nasty stuff, but without a sudo, it doesn't get Root access, with General User it has no access except to user files to delete, corrupt or load off site. Encrypted user files are not readable.

I hate to sound dense, but just to clarify. If I do my daily stuff as a general user and want to download an audiobook for example, can I do that as a general user? will i be asked for the admin name and password and then just be able to operate as usual. what it prevents is something bypassing that process, which might happen if running as and Admin user/ Is that correct?

Thank you for your patience.

Message was edited by: laverne's mom

laverne's mom wrote:

If I do my daily stuff as a general user and want to download an audiobook for example, can I do that as a general user?

>Yes, also running programs is no problem, unless it needs root level access.

Will I be asked for the admin name and password and then just be able to operate as usual.

>No, only if your trying to install a program or do things that require a Admin password. General user has it's own password as it's a seperate account.

What it prevents is something bypassing that process, which might happen if running as and Admin user/ Is that correct?

>Yes, running as General User is less priveldges than Admin user, so malware has another barrier

Running as General User is just fine for most everyone, one doesn't constantly install programs or makes so many changes that entering the Admin name and password is such a hassle as to be running in Admin user all the time.

The extra security is worth the small trouble not having your programs altered.

Clarifying again, General User is just like Admin user, except for certain things you have to enter a Admin name and password in a window that pops up.

Those times are far in between, occur when you try to alter the Applications folder mostly.

Sorry if I wasn't clear, I'm past my bedtime...ask again tommorow. 🙂

Thank you. and thank you Aria for asking this question. and if I need more clarification (always possible) I will ask when its not past my bedtime too!

Laverne's Mom🙂

Message was edited by: laverne's mom

And, after following this thread with interest, I have a followup question:

I've been running as an Admin ever since I got my first Mac (1994 or so). I never log in or out as I am the only person in the house/using it. I've never used a "General User" account and I've never had a problem because I was running an Admin account. I only visit reputable websites, I don't download "funny stuff " or things I don't know or from sites I don't know, don't go to torrent sites, don't got to social networking sites, and am generally very careful.

So, given that particular situation, I just don't see the advantage of running in a General User account? Obviously I must be missing something?

that's how I've been doing it and until I started reading all this other stuff and confusing myself I didn't think it was a bad thing to do. I know I tend to be on the paranod side, but I guess the thing to do is read the info, weigh it and decide what risks I will take or not. Like you I'm the only one using this and don't do social networks, though I do belong to two (I think reputable online forums - besides this one of course). Sometimes I think it is very easy to get overwhelmed with information. Especially when its late at night on the East Coast.

Laverne's Mom😀

then I am automatically back to using a standard account?

You never leave it; you're just getting the permission or authority from the admin user (who in this case also happens to be you) for that one operation.

I've switched over to a standard account on my 10.4, since it hasn't been supported in a few years now. For most things it's not a problem, just means a bit more typing when authenticating. But it can be a PITA if you want to run anything in Terminal as sudo, since you first need to run su - "name of admin account," then run the sudo command. Also, as a standard user, I'm not allowed to see system.log in Console without first running the su command above and then sudo /Applications/Utilities/Console.app/Contents/MacOS/Console. Then, in order to get back and see my standard user Console, I have to get out of that.

There is the contrary opinion that running as standard won't help since an exploit might just as well gain root privileges, anyway.

deleted double post

Well it all seemed to make sense to do Standard and Admin for added level of security.

So on a clean install of SL on a 2007 MBPro 3,1,

I have been installing my programs in Admin account and trying to remember to switch to Standard when setting preferences.

It seemed to be working fairly well until I installed Microsoft Office for Mac 2011.

The Word application in Admin account is fully fluffed out.

The Word application in Standard User is feeble, hardly any options at all.

I'm about to install CS5 and Lr3 but I don't want to run into this problem again.

I think I should just login in as standard user and install these Adobe programs and then just put Admin. user name and password when prompted.

In other words always login as standard user and then just put in admin user/password info when prompted.

And also just let Lightroom default my catalogue to users>pictures in my standard account and then just backup on externals.

Thanks for any input.......saving for a multi-core retina MBPro, but hardly use laptop anymore since I love my MPro w/ 24 GB ram, etc.

The practice of having standard and admin accounts certainly makes sense, and some years ago, (it is an old idea), I put it into practice.

However I soon grew tired of it, seemed like I was always having to get the keys out to unlock this, OK that. As WZZZ says, system.log is not readily available and I do like to keep an eye on that.

The differentiation of accounts is a useful feature, particularly when there is a superior and subordinary usage by several people. From an administrator's perspective it is a handy tool.

However like Babowa and Aria and presumably hoards of others, I too am the sole user.

Personally, I don't feel the erecting of an additional barrier comes with a suitable return for the cost of inconvenience when measured against perceived risk, in as much as it can be measured.

In summary, the idea is logical and sensible, but is comes at an inconvenience.

I returned to using only the Admin account.

Courtesy Kiraly, I've been using this script to open Console with admin privileges. Still not as convenient as running directly from an admin account, but faster than usng su to the admin and then dragging in a text clipping, and having to give my pword twice. Especially since 10.6 won't have many more security patches, if any, every little bit helps. (I also have Console.app replaced with Onyx.app to quickly open Onyx.)

do shell script "/Applications/Utilities/Console.app/Contents/MacOS/Console > /dev/null 2>&1 &" with administrator privileges

I don't usually have to go into system.log, or other greyed out logs, unless I suspect something that needs my attention there. Sometimes, the needed information may just be in All Messages, which is accessible from the standard user.

Sometimes, the needed information may just be in All Messages, which is accessible from the standard user.

That's a good point WZZZ, thank you.

An aside, I tried to understand All Messages once, how it was amalgamated and gave up. It also seems set to display 4000 lines and that's cast in concrete or silicon.

The system.log size can be altered so I set it to grow to 2MB and only then roll over (rotate) regardless of when. I like system.logs et al. for they are a kind of historical echo underlying the magic.