Installing apps from non-admin account

I read an earlier post that installing apps from a non-admin account is a bad idea because SL applies the wrong permissions. I normally install from a non-admin account.... I don't see that the permissions on stuff I've installed are any different from apps that came with SL. Most everything is drwxr-xr-x. Was this fixed, or am I missing the problem.

KJK555 wrote:
+"That isn't a problem at all. Applications should not require that the user have write+
+access to the application."+
I didn't say anything about a user having write access permission, I was talking about read
permissions. All apps installed in the /Applications directory should have group permissions
set to admin or wheel (depending on the type of app), so the system can read them without
problems. That's the Unix way.
I completely disagee. The system already has read permission to all applications in the /Applications folder. It doesn't matter what the group privilege is set to. The "other" permissions are set to read only. System (root) can read it regardless. If you can show me an Apple tech article that says that apps installed in the /Applications folder should have their group privilege changed to "admin" or "wheel" then I would gladly take that back.
+"Leopard does not put any ACLs on anything installed in the /Applications folder"+
That's right, it doesn't normally, but if it finds an app that it does not have permission
to read, it will assign an ACE(s) to it so that it can access it.
I just tested that in 10.5.8, and it does not happen as you say. I can't try it in 10.6. I'd appreciate if you could provide a specific example where you can make this happen.
Besides, all users, by default, have read only access to all applications. Unless a user specifically changes permissions on an app to deny read access to everyone, then this isn't an issue.
http://discussions.apple.com/thread.jspa?threadID=1875193&start=60&tstart=0
http://discussions.apple.com/thread.jspa?threadID=1866808&start=15&tstart=0
http://discussions.apple.com/thread.jspa?messageID=8776714&#8776714
http://discussions.apple.com/thread.jspa?threadID=1850256&start=30&tstart=0
http://discussions.apple.com/thread.jspa?threadID=2351437&start=15&tstart=0
http://discussions.apple.com/thread.jspa?messageID=9447059&#9447059
http://discussions.apple.com/thread.jspa?messageID=9067640&#9067640
I know what ACLs are and how they work. I have read through those and cannot find in any of those threads anything about what you had been talking about.
+"That is also false. Root rights are granted by the user entering the admin username+
+and password when prompted. It does not matter where an application is installed in+
+order for it to be given root permission."+
http://support.apple.com/kb/HT2963
"Application installers, Applications folder
A third-party application installer incorrectly sets permissions on the files it installs,
or even the entire Applications folder. Symptoms of the Application folder's permissions
being set incorrectly include applications appearing in the dock as question marks, and/or
not being able to connect to the Internet. It is also possible that software installed while
logged in as one user will be inaccessible when logged in as another. To avoid this, make sure
you are logged in with your normal user account when installing software that you wish to use
with that account."
That has to do with third party installer apps that developers have not written properly to conform to OS X standards. It isn't an issue with applications that install by drag-and-drop. It sounds to me like you have looked at the permissions that Apple has put on its own apps and jumped to the conclusion that third party apps won't work unless they have the exact same permissions applied to them. That simply isn't true.
"Software access=user access
Most applications executed by a user only have access to the files that the user has access to.
Backup software, for example, may not back up Mac OS X system files that have root ownership."
Utilities, especially disk utilities, are to be installed in the /Applications/Utilities folder, for reasons
stated above.
No. That is completely wrong. Like I said earlier, an application is given root permission by user authentication. It matters not one little bit what the application's enclosing folder is. I personally have no third party apps in /Applications/Utilities; just what Apple puts there as part of a standard OS X installation.
More permission tips:
http://www.bombich.com/mactips/image.html
http://mostlyslow.blogspot.com/2009/04/technical-mac-os-x-permissions-issues.htm l
Have you even read those? I suggest that you do; because most of what you have written about how file/folder/application permissions in OS X is completely wrong.

Similar Messages

Update iTunes from non-Admin account?

I had to install iTunes from an admin account, but I use it from an non-admin account. When I get the message that there is a new version available, can I upgrade from the non-admin account? I don't want to try it without knowing because I don't want to corrupt anything. I'm on Windows XP.

No, you log out of you limited user account and update from an administrator account.
Personally I don't trust updating from within iTunes and I always download the installer and save it on my PC before running it.
http://www.apple.com/itunes/download/
As I am rather paranoid, I make copies of iTunes Library.itl and iTunes Library.xml before updating, do this with iTunes closed. But iTunes should make a backup of its own when updating. Unfortunately if you have to update from an account that is not your usual one, it will backup the library of the account you update from, not the one you want.
Added : Actually I may be wrong in my last point. If the backup is made when you first open iTunes and it converts the library, you may be OK. But I would make a copy anyway.
Message was edited by: polydorus

Can I use Apple Configurator 1.6 to install Apps from multiple iTunes accounts on 30 iPads

Can I use Apple Configurator 1.6 to install Apps from multiple iTunes accounts on 30 iPads in South Korea?

Thank you again. I am actually just using a single computer at thsi time but will be setting up a Mac Mini in a day or so.
I actually believe I authorized my Mac Book for both my wife and my iTunes account. Yesterday when I hooked her iPhone up it told me that my computer was not authorized to download an app, i had to authorize this macbook.
So if the Apps from both iTunes account is on my Mac Book and I hook up my iPhone it will allow my to transfer the apps from my computer to my iphone? So lets say I am logged into iTunes account #1 and I try to use an app from iTunes account #2 will I have to do anything special?
Again thanks

Restoring admin account from non-admin account

For a while I've had a problems booting and logging in, which is either a HD or corruption problem, but once in to my admin account, I'm fine for the rest of the day. (This isn't a question about these problems, I know I must do something separately about that.)
This morning I had greater problems than usual, followed by a problem in my admin account - having saved a document once, the next time I got ("[document] could not be saved"). So I restarted, but couldn't get from my login account to my main admin account (after the login details box disappeared, I was left with the empty Leopard splash screen). A second restart brought the same result. I can assume my admin account has some corruption?
I'd like to restore the admin account from the Users folder on yesterday's Time Machine backup, but how do I do that from one of my other accounts, all of which are non-admin accounts?

christopher rigby1 wrote:
2. They put Leopard on my machine as - incredibly - they didn't have Tiger install disks, but they couldn't give me the Leopard install disks so I can't do a system restore.
That's a violation of the license. Legally, you're running pirated software. Worse, you can't restore OSX or Apple apps, repair your internal HD, do a full system restore from your TM backups, etc.
You need a retail Leopard disc, period. If the folks who installed it won't supply it (you might gently suggest that you'll report them to Apple), call AppleCare and pay the $129. If you're going to run Leopard, you need to pay for it.
Or, return to Tiger. On your EHD running Tiger, use the Restore tab to copy the entire Tiger OSX volume to the internal HD. Be sure to check the +Erase destination+ box. That will, of course, erase everything on your Leopard installation. You might be able to copy some of the data elsewhere temporarily, then copy it back, but any data used by Leopard may not work with the Tiger apps.
I've now determined, by trying to login to the iMac HD via Restart+option that my admin account is corrupted - I can login to every other account but not that one.
However, as I explained, i can see all its folders and files via the Tiger account with the same name and password. Here is a possible action plan, let me know what you think?
Does that sound workable?
Doubtful.

Can't run programs from non-admin account: redux

Background: I have years of experience with PCs, very little with Macs. I work with children in a group home. The tech support people who set up this iMac (OS X 10.2) have long since departed, and no one in the organization has any clue as to what changes they made to this system, and I'm sure that those tech people made some changes. For example, in admin accounts other than "root," either there is no access to the Utilities folder or the folder has been well hidden.
The Problem: The boys in this home will use a non-admin account. The programs I have installed for them will run under admin accounts but not under the "boys" account, which is non-admin. The system tells me that the account does not have enough access privileges to run the programs. (Program that had been installed before I got access to this iMac will run under the "boys" account.)
In discussions on this forum several months ago, I thought the answers I got here had helped me solve the problem. Then, for administrative reasons, I did not touch the iMac until last week. What I thought had been solved is not solved.
From "root," using the "Capabilities" option in the Accounts folder, I have added to the "Add other applications..." section the programs I want "boys" to have access to. But this doesn't work. When I log in to "boys," access is denied: insufficient access privileges.
If I give up on this system, the boys will not be able to use this iMac, and that would be a shame.

I realize that it sounds like I ignored all the previous advice before I drafted this latest post. But the first thing I did when I returned to the iMac was to look at the posts.
I didn't touch the system for six months. I was waiting for approval from administration to upgrade the OS. By the time I got the approval, upgrading was no longer an option -- according to the manager of the local Genius Bar. This system is not capable of running 10.5, and Apple will no longer sell 10.4. I can find 10.4 on the Net, but those are private sellers and the price is too high.
Now that I've got that out of the way, the current task: I have no idea why, but the gains I accomplished six months ago have disappeared. The "boys" account can run none of the software I installed. No one else has touched the system. (I live alone.)
I logged on as "root" and went to Accounts. Using 10.2's Capabilities function, I tried to check all the boxes for "boys." But when I close the screen and then re-open it, the system has unchecked "Open all System Preferences"; "Change Password"; and access to "Utilities."
At this point I cannot create new folders under "boys." "boys" can run software that was installed before I got the machine, but that's all.
I have to assume that I inadvertently did something that wiped out my previous gains. But I ain't got a clue.

Can't run programs from non-admin account

I'm new to the Mac and rusty with -- but not new to -- UNIX. I'm working with an iMac running OS X 10.2. I have installed several programs in a non-admin account (called "boys"), but they will not run from that account. The "get info" screen tells me that the "boys" account is the owner of the program. Read/write permission is enabled. When I try to run the programs, I get this error message: "The operation could not be completed because you do not have enough access privileges." I have installed the same programs in an admin account, and the programs run just fine from that account. I'd like to get this working so that the boys in the "boys" account can actually use the system. I have "inherited" this system from prior users. Programs that were on the system when I got my hands on it do run -- for the most part -- from "boys."
iMac Mac OS X (10.2.x)
iMac Mac OS X (10.2.x)

Thanks for the reply, Ken. My various unsuccessful attempts to solve this problem led me to create a folder named "Programs." (I know, my PC roots are showing.) I did this for two reasons: 1) I hoped that this would give me more control over what was happening; and 2) I wanted to give the children with whom I am working an easy way to find the programs that I want them to use. When I use < cd /users/boys > and then do an ls- l, I see the Programs folder. An ls -l on that folder shows all the program I have loaded and indicates that the "x" permission is applied to owner, group and others. Moreover, I assumed (incorrectly, perhaps) that installing the programs using the "boys" non-admin account would make them the "owner" of the programs and that "x" permission would follow. Well, ls -l indicates that they are the owners and that they do have execute permission. I can only guess that the prior users of this system -- and nobody in this organization seems to know where they are -- did something that requires more than Advil to overcome.
J...
iMac Mac OS X (10.2.x)
iMac Mac OS X (10.2.x)

Sharing external hard drive from non-admin account

We have 2 G5 Mac's in our prepress dept. at work. There is one external FW hard drive shared from G5 #1. I decided to turn the account I use on a daily basis to a non-Admin account (on G5 #1). When I do this, G5 #2 can no longer access the FW drive that is connected to G5 #1. It doesn't even show up on G5 #2 in the list of volumes to mount. As soon as I turn the account on G5 #1 back into an Admin account, G5 #2 has access to the FW drive. I've tried changing permissions on the drive and checking "Ignore ownership on this volume" all without success. No matter what I try, G5 #2 can only access the FW drive if G5 #1 is set up as Admin. Is this normal or am I missing something? Both G5's are running Tiger 10.4.11.
Eric S.

I knew what Sharepoints was but I had never used it before. Since your last post on this topic, I downloaded and installed it. I still can not make the external drive accessible to the other Mac unless my account is an admin account. Maybe I'm missing something in Sharepoints or have a wrong setting somewhere.
I'm just beginning to mess around with Terminal and Unix commands so I have no idea how to do what I'm trying to do from Terminal.
Thanks,
Eric

Installing Elements 6 (non Admin account)

I have been reading the posts in the forum regarding Elements as this is software which I am considering for purchase with Barbara Brundage's book. I have recently switched to a mac which I love and don't want to introduce problems which I might be able to avoid by asking first. Permissions etc are new to me as my experience with Windows was just to run as Admin something I don't want to do in Leopard.
I posted in one thread http://discussions.apple.com/thread.jspa?messageID=8912633#8912633
My initial concerns came from user reviews about the actual install which has now had more light shed on it as I run as a Standard user on my Mac. I have an Admin account created n day one but only use this to do my updates and install iWorks plus the new iLife when it arrives. Day to day I am a standard user but after reading the post I have linked I am now unsure if I could use Elements as a standard user even if I did the install from my Admin account.
I prefer to be a standard use on the Mac therefore would appreciate advice if it is possible to use Elements as myself or do I have to create another account (Admin user) which doesn't have all my photos etc in order to run Elements smoothly?
I am also considering Aperture but think I still need Elements for extra tools. Hopefully someone will know if this is possible as a standard user. My initial thoughts were to install from Admin account and then log out and start to use Elements as my own account but this is where the big question comes in after reading the way Adobe installs and works with permissions.
I will be prepared to wait rather than find I have introduced problems by the wrong type of install and use. Thanks for any advice, I have checked Adobe's forum and various read reviews but still haven't overcome my worries about this.

ld simply keep their photos in their Home Folder and use Photoshop Elements to process them.
Thank you Roger your help is appreciated as it helps with my other installs too.
I am still uncertain if Elements will work for me as a standard user as the other topic made me aware of problems which I presume would make my use as a standard user after the install troublesome?
Quote from http://discussions.apple.com/thread.jspa?threadID=1806242&start=30&tstart=0
+Elements needs to be installed by admin account, and to be run from the same account or you can run into a problem with certain things not working correctly. Some of the permissions on some of the files are just plain wrong. On my own install I went in and changed them to what they really ought to be so that everything works in all *admin accounts*.+
Thank you for your patience with my feeble understanding of the way Elements would work for me if I am not a day to day Admin. Hopefully I am thinking along the wrong path and I would be able to continue with my account setup using Elements after the Admin install.

Sharing volumes from non-admin accounts...

Hello,
The users in my studio regularly need to share DVDs of archived work between members of their team, however this doesn't seem to be a function available to non-admin users.
The remotely mounted DVD only shows up in the file-sharing dialogue when connecting with an administrators name/password.
Is there a way for non-admin users to share mounted CD/DVDs with network users?

So, the DVDs are on many User's machines then?
Whew... bunch of testing, but it appears that it can be done by creating a Symbolic Link on an AFP volume to the CD/DVD, then connecting via SMB... doesn't work via AFP, nor can you make/copy/ move a Symbolic Link to a Windows® volume.
I did it in Terminal using...
ln -s /Volumes/My\ Disc Folder test
But there are APPs that allow symlinks to be made easier...
Shareware... http://www.naratt.com/MakeSymlink.html
Freeware... http://seiryu.home.comcast.net/symboliclinker.html
Now... I haven't tried it with lots of Users/Permission scenarios, so you'll have to check if it works for you.

Screen sharing to OS X Lion Server with non-admin account

I have set up a Lion Server with one admin (in addition to the root user) and several non-admin normal accounts. In Server.app, I have enabled remote login with ssh, and remote management via screen sharing. I am unable to use Screen Sharing to connect to the server from the non-admin accounts, but able to use the admin account. I've read that it is only enabled for admin users, but need to access from non-admin accounts, and I can't add these accounts to the admin group. Is there a way to do this with Workgroup Manager? I tried changing the Remote Management settings in System Preferences by adding the non-admin, but when selecting 'Observe' and 'Control' in the options for the user, they are not saved.

I resolved this issue by deselecting the "Enable screen sharing and remote management" in Server.app and going to System Preferences, Sharing Preferences, Screen Sharing, and allowing access for "All Users". If you have some users you want to allow VNC, you can create a group, add the allowed users to the group, and add the group under "Only these users".

System PATH environment variable issue when user log off and log in or switch from admin to non-admin account

Hi,
Problem Description:
After installing my new product version, when user does log-off and log in again into admin account
or switch from admin account to non-admin account, PATH environment variable shows incorrect path of my product (previous product version’s path) using command prompt.
It seems windows refresh issue during session changes (log off and log in / switch from Admin to
Non-admin account).
Why PATH environment variable is not refresh immediately after log off and log in again or Switch
from admin to non-admin mode?.
Please see my thread for more details http://social.msdn.microsoft.com/Forums/vstudio/en-US/445ab42c-bdff-405a-8d53-558e1b6c7d34/path-environment-variable-issue-when-user-logoff-and-login-or-switch-from-admin-to-nonadmin?forum=windowsgeneraldevelopmentissues
Also submitted bug for this in connect.microsoft.com portal.In that it has lots of information
like problem statement, Reproduction steps and Expected Results.
Bug ID: 871782
Could you please any body help me for this?. your support will be appreciated.
Thanks,
Marichamy

Why PATH environment variable is not refresh immediately after log off and log in again or Switch
from admin to non-admin mode?.
I wouldn't have any expectation of what you are doing to work the way you expect. E.g. why is the %ABC% being replaced at all? There is some help about this ambiguous scenario in the cmd help...
/V:ON Enable delayed environment variable expansion using ! as the
delimiter. For example, /V:ON would allow !var! to expand the
variable var at execution time. The var syntax expands variables
at input time, which is quite a different thing when inside of a FOR
loop.
/V:OFF Disable delayed environment expansion.
So, what's the setting for the /V: switch that your users would be using? Perhaps you should be using the ! instead of the % for your ABC variable?
Oh. There's more below where I found that...
Delayed environment variable expansion is NOT enabled by default. You
can enable or disable delayed environment variable expansion for a
particular invocation of CMD.EXE with the /V:ON or /V:OFF switch. You
can enable or disable delayed expansion for all invocations of CMD.EXE on a
machine and/or user logon session by setting either or both of the
following REG_DWORD values in the registry using REGEDIT.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
to either 0x1 or 0x0. The user specific setting takes precedence over
the machine setting. The command line switches take precedence over the
registry settings.
In a batch file the SETLOCAL ENABLEDELAYEDEXPANSION or DISABLEDELAYEDEXPANSION
arguments takes precedence over the /V:ON or /V:OFF switch. See SETLOCAL /?
for details.
If delayed environment variable expansion is enabled, then the exclamation
character can be used to substitute the value of an environment variable
at execution time.
So, I guess the essence of your "bug" will boil down to whether you
need the feature to get the result you want and the
truth of that first sentence but it certainly looks like a "can of worms" to me. ; )
HTH
Robert Aldwinckle

HT5622 i recently bought Iphone5. I want to install apps from App store. But do i need to have a dollar account? Is it possible to download and install apps after sign in?

i recently bought Iphone5. I want to install apps from App store. But do i need to have a dollar account? Is it possible to download and install apps after sign in without register account. Maybe then as soon as i have dollar account, i can register it.

If you want to setup an account without a credt card, you need to follow the directions here EXACTLY:
http://support.apple.com/kb/HT2534

Can't login to local NON-admin accounts-Directory Access set to server

I have a strange problem on a set of laptops that I cannot resolve and am hoping someone can help me.
Here is the issue:
I have a set of building laptops (PowerPC, OSX.4.11) that seemingly will not "search locally" in the authentication process. The logins seem to work fine for NETWORK logins to our Open Directory Master xserve, but these machines will not login to any LOCAL non-admin accounts. The local root and local admin account logins do, however, work fine. ?? The remainder of the building computers (Intel iMacs OSX.4.11) appear to have the exact same settings and login fine both locally and via the network home directories.
I have tried the following:
Deleted DirectoryService preferences folder (MacintoshHD-->Library-->Preferences->DirectoryService)
Deleted the mcx cache in Directory Access
Tried adding a new non-admin user to test (still will not login)
Removed and re-created LDAP configuration (all set to custom)
Tried setting the LDAP to the automatic settings ("Add DHCP-supplied LDAP servers to automatic search policies")
Disabled all network connectivity (turned off Airport and disconnected the ethernet cable), still cannot login to local accounts
Tried to bind in LDAP configuration (when I did bind the machine, it would no longer authenticate to the network authentication server, so I did an "unbind" and restarted and it went back to performing the network logins, but still will not login to local non-admin accounts).
Reset passwords in System Prefs and also re-typed them in NetInfo Manager
Deleted login keychains
Deleted mcx.plist
Reinstalled the OS from disk and local logins worked TEMPORARILY--UNTIL I set the LDAP directory access to authenticate to our server (which I also need for the network logins to work),then, the issue started again.
*Same results with both ethernet and wireless connectivity enabled.
*Note: I also manage these local accounts via WGM (installed on the local machine) and even tried disabling that and still no luck.
Please help...I have spent hours and hours trying to find a solution and nothing seems to work! What am I missing??

Mostly just a bump...
How about that .local extension, or trailing / ?

Lightroom 3 asks for serial number launching in non-admin account

The following information was provided by Carey Burgess (Adobe Employee):
Does Lightroom 3 launch and work fine in an admin account, but when you launch the application in a standard (i.e. non-admin) account it asks for a serial number?
If so, then it is likely due to a file permissions issue either in the original (admin) account or with the standard account.
(Although you need administrator access to install Lightroom, and you do need proper access permissions to your photos, you should be able to run Lightroom without issue in a standard user account.)
Lightroom 3 stores registration data (the serial number) in a file called Lightroom 3.0 Registration, which is stored by default in one of these locations:
    * Mac OS: /Library/Application Support/Adobe/Lightroom
    * Windows XP: C:\Documents and Settings\All Users\Application Data\Adobe\Lightroom
    * Windows 7/Vista: C:\ProgramData\Adobe\Lightroom
- Check for the registration file in the appropriate location for your system.
If the file does not exist in that location, then ensure you are logged in with the admin account (the one where Lightroom doesn't prompt for a serial number) and check the user-specific location instead:
    * Mac OS: /Users/YOUR USER NAME/Library/Application Support/Adobe/Lightroom
    * Windows XP: C:\Documents and Settings\YOUR USER NAME\Application Data\Adobe\Lightroom
    * Windows 7/Vista: C:\Users\YOUR USER NAME\AppData\Roaming\Adobe\Lightroom
If the file exists in the user-specific location instead, then I would suggest that you ensure that you have quit Lightroom, and then move the registration file from the user location to the default system-wide location. Lightroom should now no longer prompt for serial number when you open it from a non-admin account.
If the registration file did (or now does) exist in the default system-wide location, but you are still being prompted to enter a serial number when opening Lightroom in a standard user account, then that account does not have sufficient access permission to the registration file.
To resolve this aspect, there are two possible solutions (the first being the recommended solution):
1. Change the access permissions on the Lightroom folder that contains the registration file to grant "Read" access for the standard user account. (You can do this for each account individually, or you can use a broader group like Everyone.)
For more information about changing permissions, see one of these articles:
    * Windows XP: http://support.microsoft.com/kb/308419#4
    * Windows Vista/Windows 7: http://windows.microsoft.com/en-us/windows7/What-are-permissions
    * Mac OS: http://docs.info.apple.com/article.html?path=Mac/10.6/en/8342.html
2. Copy the registration file from the system-wide location to the user-specific location for the standard user account. (You would need to repeat this step for each standard user that needs access to Lightroom.)
Reply here if these steps do not resolve your issue, or if you have any questions.

Months ago, I had a routine clearout of old software boxes etc and chucked out my Lightroom 1.0 box. A couple of weeks ago I reinstalled Lion on my mac to find that I cannot register Lightroom. I have the 3.0 upgrade serial, the 2.0 upgrade serial, but the 1.0 was on the box..
I followed the instructions above to find the files in crashplan form before the fomat that hold the registration details. I have tried placing them in the location described, but it doesn't seem to work.
The serials (or something) are in the file, but given in the string that is difficult to decipher - and doesn't work in the registration screen, wrong size and a mix of letters and numbers rather than just numbers as my 3.0 serial is.
Any suggestions for what I could do? Could I send the strings in to Adobe to be deciphered? Perhaps move files around a bit more?
Thanks in advance,
Rog.

Reader X will not open (non-admin account)

I installed Adobe Reader X on an admin account for the computer. On the non-administrator accounts, Adobe Reader X will not open. There are no error messages or anything - it just will not open in non-admin accounts. Is there a setting I've overlooked to allow other users to access it?

How do you open the Reader on the non-admin account - directly (from the Start menu or desktop shortcut), or by double-clicking a PDF file?
After you do that, can you check with the Task Manager's Processes tab if AcroRd32.exe is running?

Installing apps from non-admin account

Similar Messages

Maybe you are looking for