JimmyCMPIT

Q: proper way to change admin accounts to standard

I'm looking for the proper way to change some of the administrative accounts on macs I support from Administrative to Standard.

the systems in question have at least two adminsitive accounts and I will only be performing this on one of those accounts.

currently there is data for the users (images, music, etc.) in their home accounts.

 

Is this simply a question of going in as an admin on one account, selecting the other account and turning off the "allow user to administrate this computer" checkbox or is there more to it, like creating entirely new accounts?

 

this is also predominantly a 10.9 question but I have a system running 10.10 that also needs to be addressed.

Mac Pro, OS X El Capitan (10.11.2), Dual Xeon 2.4, 64 GB RAM

Posted on Apr 29, 2016 6:58 AM

Close

Q: proper way to change admin accounts to standard

  • All replies
  • Helpful answers

  • by Niel,Apple recommended

    Niel Niel Apr 29, 2016 7:07 AM in response to JimmyCMPIT
    Level 10 (311,916 points)
    Apr 29, 2016 7:07 AM in response to JimmyCMPIT

    It only involves turning off that checkbox.

     

    (141917)

  • by JimmyCMPIT,

    JimmyCMPIT JimmyCMPIT Apr 29, 2016 7:08 AM in response to Niel
    Level 5 (6,968 points)
    Mac OS X
    Apr 29, 2016 7:08 AM in response to Niel

    Let me put it into practice with the systems and I will give you the correct if this is the case but thank you for the starting point in the mean time.

  • by BobHarris,Apple recommended

    BobHarris BobHarris Apr 29, 2016 8:33 PM in response to JimmyCMPIT
    Level 6 (19,272 points)
    Mac OS X
    Apr 29, 2016 8:33 PM in response to JimmyCMPIT

    Is this simply a question of going in as an admin on one account, selecting the other account and turning off the "allow user to administrate this computer" checkbox or is there more to it, like creating entirely new accounts?

    The only difference between an 'admin' user and a normal user, is that the 'admin' user is a member of the group 'admin'

     

    From an Applications -> Utilities -> Terminal session you can look at what groups a user is a member of

    This is my 'admin' account

    id

    uid=501(me) gid=20(staff) groups=20(staff),401(com.apple.sharepoint.group.1),12(everyone),61(localaccount s),79(_appserverusr),

    80(admin),81(_appserveradm),98(_lpadmin),33(_appstore),100(_lpoperator),204(_developer),3 95(com.apple.access_ftp),

    398(com.apple.access_screensharing),103(com.apple.access_ssh-disabled)

    This is a normal user account (I call 'testing')

    id

    uid=502(testing) gid=20(staff) groups=20(staff),12(everyone),61(localaccounts),398(com.apple.access_screenshar ing),

    103(com.apple.access_ssh-disabled),401(com.apple.sharepoint.group.1),100(_lpoper ator)

    The key ingredient to an admin account is the ability to become the 'root' user.  And this is controlled by the /etc/sudoers file and this 1 line in that file

    %admin  ALL=(ALL) ALL

    If you are a member of the 'admin' group, you get to do admin things.  If you are not a member of the 'admin' group you do not have any special privileges.

     

    And giving or taking away whether you have 'admin' group is, as says, "It only involves turning off that checkbox. (141917)".  Nothing more is required beyond that.

  • by xword,

    xword xword Aug 24, 2016 1:46 AM in response to BobHarris
    Level 1 (4 points)
    Aug 24, 2016 1:46 AM in response to BobHarris

    I have the same issue - but what if that checkbox is greyed out?

     

    Like Jimmy, my users have been using their admin accounts for some time and have files and settings built up over time.  We now want to make a company switch from admin to user status for day to day use, so I have created a second admin account on each Mac.  When I try to disable the admin rights to the first account, it is greyed out.

     

    Any help would be much appreciated.

  • by BobHarris,

    BobHarris BobHarris Aug 24, 2016 5:53 AM in response to xword
    Level 6 (19,272 points)
    Mac OS X
    Aug 24, 2016 5:53 AM in response to xword

    xword wrote:

     

    I have the same issue - but what if that checkbox is greyed out?

     

    Like Jimmy, my users have been using their admin accounts for some time and have files and settings built up over time.  We now want to make a company switch from admin to user status for day to day use, so I have created a second admin account on each Mac.  When I try to disable the admin rights to the first account, it is greyed out.

     

    Any help would be much appreciated.

    Then click on the padlock in the lower left hand corner and enter the admin account name and admin password to unlock the padlock

     

    And there must be at least one other admin on the system, or it will not allow you to take away the last admin.