Administrators vs. user accounts

I'm a new owner. I set myself up as the administrator, and my kids as users. Then, I downloaded Microsoft Office Mac (Word, Excel, Powerpoint) when I was logged in, but my kids can't access it when they log in. Do I have to make everyon an administrator? That doesn't seem like the way to go for security reasons. On the other hand, I can't see downloading separately to each of their acounts. Any way to give other users access to this software when they log in?

Hopefully elmac's response about granting permission has helped you. That's how I make sure the kids aren't taking tons of photos in Photo Booth (which I have to go thru and delete), but are able to access Word and Excel. I also find that applications, etc have to be in the Hard Drive section (folder) of the computer so that everyone can access them (with permission for non administrative accounts.)
I have heard that on the Mac you can have user time limits. I would like to set this up for my kids, so that they have a maximum of computer time each day or week. But I cannot find where I might set this. Any ideas?

Similar Messages

LDAP Query for particular user account in local Administrators group on All Enabled Computer Accounts

Need to query on all enabled computer accounts that have a particular user account present in the local Administrators group.
Ldap query is best, because not all our machines have SCCM client
Thanks for any help you can provide. Lisa

Ya, I have 41800+ computer accounts in my directory. I think that option is not feasible :) Thanks for your reply.
I can use SCCM to do this too, but only for those that the client is running on and which are online. Thanks again.
Hope is not all lost; a scripting solution is still possible. The difference is instead of running a central script to pull info from all computers, you let the computers report back to you with the info.
If I were you, I'd do the following:
1) Create a file share and adjust the permissions so that "Domain Computers" have "Modify" Permissions.
2) Create a script similar to the 2nd link I posted above, with a bit of adjustment: at the end of the script, write the information to the file share created in (1), and name the file
ComputerName.txt
3) Use Group Policy Preference Scheduled Task to deploy the script, and make sure it only runs once.
4) Happily wait for the results to come back :)
The main benefit of this approach is you're not restricted by the computer connectivity at the moment you run the script. This is especially true if you have many mobile computers in your environment. Just wait for a reasonable time (they all need
to come back to the mother ship once a while don't they?) and the results will show up in the file share you created.
Cheers.

Understanding user accounts, administrators, volumes, permissions, etc.

I'm totally flummoxed by the variations and differentiations of users, accounts, short names, long names, volumes, etc. A lot of this happened as we now have 3 macs, in addition to external drives on one G5. I feel like I'm a newbie asking these questions, even though I've been a Mac user since '88.
1. On the individual machine, in the default finder window I see, in one case, "<My Name>s' Computer." When I got a MBP, I wasn't thinking and set it up as well as "<My Name>'s Computer." When I network between the two through browsing, the MBP was renamed "<My Name>'s Computer(2). How can I change the name of one computer so that I don't have this confusion? I foolishly renamed a user and just learned that doesn't solve the problem and creates other problems.
2. Also, is that name "<My Name>'s Computer" the "long name?" When I created the new user problem, I still see a user "<myname>" all lower-case, no spaces. Is that the short name? And, the directory under Users now includes a "<myname>" with only a few folders of recent docs. Was that created when I renamed that user?
3. On the G5, I have 2 user accounts, mine & my wife's. My account is also the admin account. However, I find that if I'm logged in as myself (admin) and I want to look at all of her folders, I'm locked out. Even if I try to Get Info and change the read/write permissions, sometimes I still can't access those folders. (I'll add that she doesn't know beans about permissions and we have a nice, open relationship!)
4. Should there be an admin account with superuser rights on all machines? Is it okay if there's a user who is also admin?
5. When I browse for another machine, I see "<My Name>'s Computer" but then when I connect to that machine and I log in as one of the registered users for that machine, I see volumes, which can lead to users, but locks me out of those user's files.
6. I see some help on these boards through postings which link to Technical Articles, but is there any good online resource or book recommended? Of course, the technical articles have links, but they are not sequenced, so they have no context. Mac Help is not terribly detailed.
B&W G3, 2Ghz G5, MacBook Pro, Mini, lots of boxes with wires and lights and things Mac OS X (10.4.7)

Hi Lee,
1. On the individual machine, in the default finder window I see, in one case, "<My Name>s' Computer." When I got a MBP, I wasn't thinking and set it up as well as "<My Name>'s Computer." When I network between the two through browsing, the MBP was renamed "<My Name>'s Computer(2). How can I change the name of one computer so that I don't have this confusion? I foolishly renamed a user and just learned that doesn't solve the problem and creates other problems.
renaming the drive with disk utility should work.
2. Also, is that name "<My Name>'s Computer" the "long name?" When I created the new user problem, I still see a user "<myname>" all lower-case, no spaces. Is that the short name? And, the directory under Users now includes a "<myname>" with only a few folders of recent docs. Was that created when I renamed that user?
yes, thatt's the shortname
3. On the G5, I have 2 user accounts, mine & my wife's. My account is also the admin account. However, I find that if I'm logged in as myself (admin) and I want to look at all of her folders, I'm locked out. Even if I try to Get Info and change the read/write permissions, sometimes I still can't access those folders. (I'll add that she doesn't know beans about permissions and we have a nice, open relationship!)
Only the root user can view the contents of another user's account.
4. Should there be an admin account with superuser rights on all machines? Is it okay if there's a user who is also admin?
yes, you can have multiple admins. you need at least one admin on each machine (unless you're running a server environment.
5. When I browse for another machine, I see "<My Name>'s Computer" but then when I connect to that machine and I log in as one of the registered users for that machine, I see volumes, which can lead to users, but locks me out of those user's files.
refer to root user comment.
6. I see some help on these boards through postings which link to Technical Articles, but is there any good online resource or book recommended? Of course, the technical articles have links, but they are not sequenced, so they have no context. Mac Help is not terribly detailed.
try Google or Amazon when looking for self-help/guide books on OSX
hope this is ok
regards,
Pete.

How can I use iweb 1.1.2 for more than one user account on my macbook?

I wonder if someone can guide me or point me to a previous answer on this, since I haven't found one. I'm simply trying to use iweb 1.1.2 on two user accounts (both labled as administrators) on our macbook. The program functions fine on one account, but when I switch over to another user account on the computer iweb will open, but does not let me start a new page, save, etc.
Thanks much for any response.

Welcome to the discussions. If iWeb's menus are greyed out, the following trick has worked for some:
In the user account which does not let you start a new page, save, etc. — Quit iWeb. Start iPhoto. Select a couple of photos, click on the iWeb icon at lower right and choose Photo Page. iWeb will open up and invite you to choose a template for your new Photos page. Choose any template so that the page is created and then delete that newly created page.
...Now perhaps things are no longer greyed out in iWeb.

Problem with 2 user accounts on one iMac

There are two user accounts on our home iMac. Both are set as administrators. When my partner accesses the backup drive (Seagate FreeAgent GoFlex), he can open all of the backup files.
When I try to access the backup files, there is no access listed for me. When I click Get Info on any of the locked folders, I am not even listed as a user (only the other admin and "everyone else" are listed).
As an admin, I can manually add myself as an administrator and eventually open all the backup files. I've given myself admin access to the Seagate drive, but I still have to give myself admin access on the individual backup files.
1. Why is this happening?
2. Is there a faster way to grant me access to the backup files?
Here's the backstory:
I had upgraded to Lion in August but since then, performance dropped radically. I backed up the iMac and then clean installed Snow Leopard. My mac is totally back to normal. Since then, I have administrator access to only the files backed up with OS 10.6.8 but everything backed up under 10.7 is locked. But they're NOT locked for the other administrator account. Like I said, I can go and grant myself access to the files, but I don't understand why I have to go through that.
Ideas?
Thanks in advance for help and answers.

Do a get info on the backup drive. Open up the Sharing & Permissions section if necessary. Unlock the drive permissions by clicking on the lock icon. Input admin password etc. If you are not already listed as having read/write access to the drive, do that now (add your account name if necessary with the plus button). Now click on the gear icon and select "Apply to enclosed items..." Relock the drive permissions by clicking on the lock icon. You should be good to go now.

ITunes does not launch with new User Account (Vista)

One of my limited user accounts on Windows Vista because corrupt, so I created a new limited User Account and copied ALL of the files from the old to new.
Now, when I try to launch itunes on the new user account, it will not open at all. Itunes works on my administrative account, with no problem.
Can someone tell me the most pain-free way to resolve this issue. And, whatever solution, will I be at risk of losing my itunes libraries?
Thank you in advance.

Hiya. Delayed again. Browsers being cranky. (I blame the aftershocks.)
It's actually plausible that it was installed in there (by doing a run as administrator on the installer itunes64setup.exe, perhaps). Because that suggests a possible cause for these continual permissions-related problems.
A lot of what you're seeing is consistent with damaged ACLs (access control lists) on files, folders and registry keys. Although it's a lot rarer than it used to be, one of the ways you could get borked ACLs was if a program (like iTunes or QuickTime) was installed in one user account, and then the user account it had been installed in was deleted (or otherwise rendered unusable).
We don't know which particular permissions are stuffed up here. But there's a shotgun approach to fixing them which used to work okay, although it's a bit fiddlier to do on a 64-bit system than a 32-bit system.
I'd strongly recommend setting up a system restore point prior to doing this, so you can revert if things turn to custard.
The basic technique you follow is from the following blog entry *with one important modification.*
[Solving setup errors by using the SubInACL tool to repair file and registry permissions|http://blogs.msdn.com/b/astebner/archive/2006/09/04/solving-setup-e rrors-by-using-the-subinacl-tool-to-repair-file-and-registry-permissions.aspx]
The modification is that when you're editing the file to replace YOURUSERNAME with the name of the account, edit the first line so that %ProgramFiles% instead says %ProgramFiles(x86)% and after the line that reads:
*subinacl /subdirectories %programfiles%\ /grant=administrators=f /grant=system=f /grant=users=e >> %temp%\subinacl_output.txt*
... add another line saying:
*subinacl /subdirectories %programfiles(x86)%\ /grant=administrators=f /grant=system=f /grant=users=e >> %temp%\subinacl_output.txt*
(The first is to make sure the commands see the subinacl, because it installs in \Program Files (x86)\ on 64-bit systems, and the second alteration is to make sure that the permissions for the 32-bit program files are fixed too.
After doing that (it'll take a while to run), can itunes launch normally in the new account?

User Account Control FireFox issue in Windows 7 - ULTIMATE SOLUTION!!!

== Issue
==
I have another kind of problem with Firefox
== Description
==
Trying to figure out why some people where able to use "Run as Administrator" fix and for others like me it did nothing. The answer is what type of Win7 you have. If you have Win7 Ultimate or Enterprise you can go into the Local Securities Policy Editor and prevent the UAC dialog box opening for an administrator.
However, if like me you have Home Premium or Home editions there is NO editor in the OS and this setting has to be modified through the registry.
This page has the full explanation and zip file of the registry hack: http://www.howtogeek.com/howto/windows-vista/disable-user-account-controluac-for-administrators-only/
So I downloaded the file, unzipped it and merged it with the registry - then set my Compatibility properties for the FireFox shortcut to "Run as Administrator" and it runs GREAT!!
== Troubleshooting information
==
This page has the full explanation and zip file of the registry hack: http://www.howtogeek.com/howto/windows-vista/disable-user-account-controluac-for-administrators-only/
Downloaded the file - http://www.howtogeek.com/geekers/DisableUACforAdministrators.zip, unzip it and merge it with the registry - then set your Compatibility properties for the FireFox shortcut to "Run as Administrator" and it runs GREAT!!
== Firefox version
==
3.6.6
== Operating system
==
Windows 7 Home Premium
== User Agent
==
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6
== Plugins installed

Check that you do not run Firefox as Administrator.
Right-click the Firefox desktop shortcut and choose "Properties".
Make sure that all items are deselected in the "Compatibility" tab of the Properties window.
* Privilege Level: "Run this program as Administrator" should not be selected
* "Run this program in compatibility mode for:" should not be selected
Also check the Properties of the firefox.exe program in the Firefox program folder (C:\Program Files\Mozilla Firefox\).

New iMac 21.5". How can I set up a new user account with access to all the files of the original user account?

Running Mavericks on a 2013 iMac 21.5". I want to set up a second user account with different settings that meet the requirements of specific software. I need the files to be accessible by both users. I have made both the main and secondary accounts administrators. I have also enabled file sharing for both. Neither account can see the other's files in Finder.
How can I make all files accessible to both accounts? I read that administrator accounts automatically can see all files on the computer, but it is not working out that way. I have restarted the computer, to no avail.

Comcast only offers POP accounts, and one way to set up the account and enter all the settings before it connects to the mail server, might be to do it Offline:
https://support.mozilla.org/en-US/questions/991539#answer-547878
The server settings are given [http://customer.comcast.com/help-and-support/internet/setting-up-thunderbird/ here], but the method is for Online account setup.

How do I get firefox to up date from a standard user account....or at least tell me to log on as administrator and update?

I do almost all my work from a standard user account. Firefox neither automatically updates (as I set it to) or informs me an update is available.
How do I get Firefox to update automatically when I am logged on as a standard user....or at least tell me to switch to admin account and update?

Let me add a note to the developers: WE ARE ALL NOT ADMINISTRATORS!
Even on our own personal computers.
I claim that administrator accounts are for administering, or developing; not using. I wouldn't be an administrator for longer than is necessary than walk down the centre of a highway with my eyes closed.
I'll repeat: Mozilla really should prevent the 'Update' button showing to an ordinary user if it's not going to be possible to use it.

To view "Daily ID Administrators Activity" & "Dormant Accounts"

Dear Hyperion Users,
I am looking out for the below ones on Hyperion 9.3.1.
1. Daily ID Administrators Activity [User maintenance, to track any changes on user's access, etc]
2. Dormant Accounts - Account which are not used or which are idle for certain time [Lets say user who hasn't logged on for 3 months] and remove/clean up the accounts.
I have opened SR with Oracle on the above 2 points and they conveyed that Hyperion 9.3.1 doesn't provide any of the above information.
3. User Access Profile Listing : I could log on to Shared Services and create User access listing report via "Administration" -> "View Report".
We have Hyperion Planning, HFM, Essbase and BI+ applications and I need your help in finding posibility of creating customised query or find way to get these "Daily ID Administrators Activity" & "Dormant Accounts" information for my Hyperion Applications.
Thanks in advance.

Finding dormant accounts in Essbase specifically (so it depends what you mean by 'Hyperion', but you are posting in the Essbase forum :) ) comes up frequently. I believe the information in this thread - Info of Last login details of Users - is still accurate, and I'm sure it would be correct regarding 9.3.1.
EDIT: Must have read that too quickly, as I see you've listed your apps - but what I wrote above stands re Essbase!
Edited by: TimG on Oct 24, 2011 11:52 AM

Access Denied creating user accounts through vba

Hello,
I have a MS-Access application that runs on a Windows 2012 server. My customer logs into the server using RDP. The MS-Access application is started up automatically by means of the environment variable in the user settings. The customer needs to be able
to create new windows users for this application, simply by clicking a button.
The VBA script to create users works, because when I start up the MS-Access application with my own logged on Administrators account, the new users get created. If my customer tries it, he gets 'Access Denied' error. I have added his user account to
the Power Users group, but that did not solve the problem. I also tried to make him member of the DCOM Users Group, the 'Access Denied' error remains...
I do not want to give him administrator priviliges, because he is 'just a customer'...
What do I need to do for this setup to work? I tried altering some DCom settings, but frankly I do not have enough knowledge to feel comfortable with this. Hope anybody can help me out here...
best regards, Rob

Is this a standalone server? Only administrators can create user accounts, so there is no work around for that. You could look at something that has the administrator account/password stored and launch PSEXEC or something else in an elevated session behind
the scenes but that is a security volunerability because the credentials are stored.
If the account is being created in an Active Directory environment you could delegate permissions to the appropriate OU for your customer.
Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years.

How can I auto load Safari thru a non-Admin user account

Okay, maybe I don't want to do this - - but can I?
I have my old iMac setup to turn on at 8am. I would like to access it remotely through LogMeIn.com. But I need Safari running for remote access.
I'd prefer to have Safari running in a 'Guest' User Account with no Admin rights (then from LogMeIn.com, switch to my user account and I can enter my password manually).
I know how to auto login to a Guest account, but how do I have that account auto start Safari? Only Administrators can have programs start automatically, right?
I don't want to auto-login (with password if that's even possible) to my main Administrator account.
Any suggestions?
Thanks in advance

I use iKey to remap the keys. It has a little more function then youpi key. For many years, I used youpi key before switching to iKey.
In addition, ikey will allow you to run ikey applications when ikey starts.
!http://farm3.static.flickr.com/2700/4178949301_cea8fa07a2.jpg!
You might like iKey/youpi key. I have my frequently used applications set to f keys. The same f key starts an application and switches to the application.
Youpi key is free. It works fairly well for me in MAC OS 10.4 although not officially supported. There is a commercial version you can buy, called iKey.
http://www.versiontracker.com/dyn/moreinfo/macosx/11485&vid=75326
I have the common programs that I use assigned to function keys. I have F4 assigned to Firefox. When I want to start FireFox, I press F4. When I want to switch to firefox, I press F4! Starting & switching to an application in Mac OS are the same thing in Mac OS.
Here is an example of to assign volumn control to a function key.
http://discussions.apple.com/message.jspa?messageID=10361085#10361085
Here is a solution with XTool. XTool Uses exact screen addresses. So a movement of an icon will cause you trouble.
do shell script "/usr/sbin/system_profiler SPDisplaysDataType | grep 'Resolution'" -- get info
tell the result to set {DisplayWidth, DisplayHeight} to {word 2, word 4} -- get resolution
--move mouse {DisplayWidth div 2, DisplayHeight div 2} -- center mouse
move mouse {670, 13} --sound
click mouse
move mouse {673, 96} --sound level
click mouse
move mouse {555, 282} -- center mouse
click mouse
   First, there is the XTools scripting addition, which will give AppleScript the ability to move the mouse.
   http://www.lestang.org/osax/XTool/
   XTool-2.0-src.dmg.tgz
   Installation :
   Drag
.osax from insite the image to one of the following locations (create the directory if it does not exist) :
a : ~/Library/ScriptingAdditions/
   b : /Library/ScriptingAdditions/
   c : /System/Library/ScriptingAdditions/
   I have it in directory /System/Library/ScriptingAdditions/
   My other two directories do not exit: ~/Library/ScriptingAdditions/ &
      /Library/ScriptingAdditions/
.    Next, you will need to place a script application into your login items (System Preferences > Accounts > Login Items) that will move the mouse when you log in:

How to force password policy requirements on password resets for user accounts reset by the Administrator?

OS: Windows Server 2008 R2 Enterprise
Domain Level: 2008
Forest Level: 2000
We have Domain Administrators in our domain that reset passwords for user accounts, and the passwords the Administrators set them to are not being enforced follow our default domain password policy. For example, I log on the domain controller, as an administrator
and can reset a password for a user account to be blank.
Is there a reason Domain Administrator password resets for user accounts are not enforced by our default domain password policy? Is there a way to enforce this on password resets by Domain Admins?

Do you have fine grant password policy? If not ; by default all the usrs are effected by domain level password policy even domain admins,
Regards~Biswajit
Disclaimer: This posting is provided & with no warranties or guarantees and confers no rights.
MCP 2003,MCSA 2003, MCSA:M 2003, CCNA, MCTS, Enterprise Admin
MY BLOG
Domain Controllers inventory-Quest Powershell
Generate Report for Bulk Servers-LastBootUpTime,SerialNumber,InstallDate
Generate a Report for installed Hotfix for Bulk Servers

When I click on the icon to start firefox, the screen dims and I get this question in a dialogue box from User Account Control....."Do you want to allow the following program to make changes to this computer"

Every time I start firefox

'''If you have Windows-7: Home Basic and Home Premium this works.'''
1. Create a new text file
2. Copy the text below into it.
<code>
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000000
</code>
3. Save as, e.g. DisableUACadmin.reg The reg extension is recognized by the registry editor.
4. Double-click your file and accept everything.Then do PART II below.
'''If you have Windows-7: Professional (Business), Enterprise and Ultimate Editions this works.'''
1. From the START MENU open the Control Panel and click on the Administrative Tools icon.
2. Double click on Local Security Policy to open it.
3. Browse down to Local Policies and then down to Security Options
4. In the list find: “User Account Control: Behavior of the elevation prompt for administrators in Admin Approval
Mode” and double-click on it.
5. Using the dropdown window change the setting to “Elevate without prompting”.
6. Close out all your windows and do PART II below
'''PART II'''
For all versions of Windows-7, now you can right-click the FireFox icon and select properties. Click on the Compatibility tab and select "Run this program as an Administrator".
No more UAC for Firefox.

The connection was denied because the user account is not authorized for remote login

Using Terminal Server 2008 not able to get non administrator users to login to the remote desktop. Have tried from Windows server 2008 and from Windows servers 2003. Get error login in "The connection was denied because the user account is not authorized for remote login" from Windows Server 2008. Error "The requested session access is denied" from Windows Server 2000.

Is that seriously the only way to do this? Doesn't this render the "Allow log on through Terminal Services" GP Setting useless?
I would like to know this answer, as well. I have created a new AD group for my assistant admins called "Domain Admins (limited)". I have added this group to the GP setting "Allow log on through Terminal Services", but the
assistant admins cannot log in through RDP. It 'feels like' this is all I would need to do.
Craig
Found some good info
here. There are really two things required for a user to connect to a server via RDP. You can configure one of them via Group Policy but not the other.
1) Allow log on through Terminal Services can be configured through Group Policy, no problem.
2) Permissions on the RDP-listener must also be granted. If your user is a member of the local Administrators group or the local Remote Desktop Users group then this is handled. If you are trying to utilize a new, custom group (as I am),
then there isn't a way to do this via group policy (that I have found).
EDIT: Found the answer. I am creating a blog post to outline the steps. They aren't hard, but they're not self-explanatory. It deals with the Restricted Groups mentioned above, but it's still automate-able using Group Policy so that you
don't have to touch each computer. I think the above poster (Andrey Ganev) got it right, but
I had trouble deciphering his instructions.
Here is my blog post that walks through this entire process, step-by-step.

Administrators vs. user accounts

Similar Messages

Maybe you are looking for