Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

proper way to change admin accounts to standard

I'm looking for the proper way to change some of the administrative accounts on macs I support from Administrative to Standard.

the systems in question have at least two adminsitive accounts and I will only be performing this on one of those accounts.

currently there is data for the users (images, music, etc.) in their home accounts.


Is this simply a question of going in as an admin on one account, selecting the other account and turning off the "allow user to administrate this computer" checkbox or is there more to it, like creating entirely new accounts?


this is also predominantly a 10.9 question but I have a system running 10.10 that also needs to be addressed.

Mac Pro, OS X El Capitan (10.11.2), Dual Xeon 2.4, 64 GB RAM

Posted on Apr 29, 2016 6:58 AM

Reply
Question marked as Best reply

Posted on Apr 29, 2016 7:07 AM

It only involves turning off that checkbox.


(141917)

7 replies

Apr 29, 2016 8:33 PM in response to JimmyCMPIT

Is this simply a question of going in as an admin on one account, selecting the other account and turning off the "allow user to administrate this computer" checkbox or is there more to it, like creating entirely new accounts?

The only difference between an 'admin' user and a normal user, is that the 'admin' user is a member of the group 'admin'


From an Applications -> Utilities -> Terminal session you can look at what groups a user is a member of

This is my 'admin' account

id

uid=501(me) gid=20(staff) groups=20(staff),401(com.apple.sharepoint.group.1),12(everyone),61(localaccount s),79(_appserverusr),

80(admin),81(_appserveradm),98(_lpadmin),33(_appstore),100(_lpoperator),204(_developer),3 95(com.apple.access_ftp),

398(com.apple.access_screensharing),103(com.apple.access_ssh-disabled)

This is a normal user account (I call 'testing')

id

uid=502(testing) gid=20(staff) groups=20(staff),12(everyone),61(localaccounts),398(com.apple.access_screenshar ing),

103(com.apple.access_ssh-disabled),401(com.apple.sharepoint.group.1),100(_lpoper ator)

The key ingredient to an admin account is the ability to become the 'root' user. And this is controlled by the /etc/sudoers file and this 1 line in that file

%admin ALL=(ALL) ALL

If you are a member of the 'admin' group, you get to do admin things. If you are not a member of the 'admin' group you do not have any special privileges.


And giving or taking away whether you have 'admin' group is, as Niel says, "It only involves turning off that checkbox. (141917)". Nothing more is required beyond that.

Aug 24, 2016 1:46 AM in response to BobHarris

I have the same issue - but what if that checkbox is greyed out?


Like Jimmy, my users have been using their admin accounts for some time and have files and settings built up over time. We now want to make a company switch from admin to user status for day to day use, so I have created a second admin account on each Mac. When I try to disable the admin rights to the first account, it is greyed out.


Any help would be much appreciated.

Aug 24, 2016 5:53 AM in response to xword

xword wrote:


I have the same issue - but what if that checkbox is greyed out?


Like Jimmy, my users have been using their admin accounts for some time and have files and settings built up over time. We now want to make a company switch from admin to user status for day to day use, so I have created a second admin account on each Mac. When I try to disable the admin rights to the first account, it is greyed out.


Any help would be much appreciated.

Then click on the padlock in the lower left hand corner and enter the admin account name and admin password to unlock the padlock


And there must be at least one other admin on the system, or it will not allow you to take away the last admin.

Sep 18, 2016 5:22 AM in response to BobHarris

I have the same problem than word. But even if you unlock the padlock, it keeps showing the checkbox greyed out.

I think I have the same problem: Bought a computer for my daughter. She was the admin from day one. All files and apps associated to her account.

Now, I want to set some time limits, so I want to be the admin and give her a standard account, but even though I can create a second admin account, I can't change hers to standard. What can I do?

proper way to change admin accounts to standard

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.