Preventing local admin from changing root password

Is it possible to prevent a local admin from changing the root password? I would like to set up a computer so that the user has admin rights, but cannot change the root password via a terminal shell to gain root access.

I can't provide you with details, but I'm sure that all you need to do is to edit the sudoers file. It needs to be edited with <visudo> when logged in as root in a Terminal. The location is </private/etc/sudoers>, but you don't need to know that when using <visudo>. From a first look I'd suppose you only have to uncomment the %admin line, but better get some more information. I never did this myself.

Similar Messages

Prevent non-admins from using passwords...

Title says it all haha, I have a iMac for the kids and I have an admin account with a password and I was wondering how can I (if I can) prevent them from making passwords for their non-admin accounts?
Thank you,
TM

..."prevent them from making passwords"...
If this means that the accounts currently do not have passwords, that generally is considered unsafe, although with appropriate security measures in place to protect the local network, it might be alright (I don't consider myself knowledgeable enough to provide advice on what those measures might be). Nevertheless, an "admin" can simply set a blank password for any account using the "Accounts" pref pane, while logged in to any account except the one whose password is being changed.
However, if the question is really about preventing the users from changing their own password, OS X does provide an option through "System Preferences" > "Accounts" > "Parental Controls" > "Finder.app & System" where an "admin" can set whether or not it is allowed. There is a loophole but it's fairly obscure, and it can probably be closed if the need arises.
Keep in mind that an "admin" can change any user's password at will so even if the users decide to change it, an "admin" can always change it back. An "admin" always has access to almost any file on the computer, with the exception of those that are encrypted (eg. keychains, encrypted disk images, including "FileVault", etc.) so the kids can't really lock you out, if that is the concern.

Prevent local administrators from opting out of Microsoft Updates / accessing Windows Update "Change settings" page

Hello,
Is there a a group policy setting / dll file / registry setting that I can restrict access to that would either:
A) prevent local administrators from unchecking the "Give me updates for other Microsoft products when I update Windows" box?
or
B) prevent access to the "Change settings" option on the left side of Windows Update?
Thanks!

> referring to the "Remove access to use all Windows Update features"
Yes.
> enabling this group policy setting would disable Windows Update and
No. It removes access to windows update, not windows update itself. If
you enable it, you have to make sure that windows update is properly
configured:
http://gpsearch.azurewebsites.net/#2791
>
https://technet.microsoft.com/en-us/library/bb490846.aspx). This is not
This article is - hum - somewhat outdated :)
Greetings/Grüße,
Martin
Mal ein
gutes Buch über GPOs lesen?
Good or bad GPOs? - my blog…
And if IT bothers me -
coke bottle design refreshment (-:

How to stop an unauthorized user from changing my password.

How do I block an unauthorized user from constantly changing my password?
I had an old iPod Gen 4 stolen and someone from China is downloading Apps (I get email alerts when they download something and the last message said the computer used is registered in China). I have changed the account password many times. However, days later, I will get an alert email that my password was changed (not by me), or I will try to purchase something and my password will not work. How else can I block this person from changing my password so he/she can use my account? Will changing my user email address work? Should I deactiviate all authorized computers to wipe them out? I do not have any credit cards tied to my account, so they are only downloading free apps.

Hi Gradux,
Welcome to the Apple Support Communities! In this situation, I suggest contacting the application developer. The information on how to do that can be found in the following article.
iOS: An app you installed unexpectedly quits, stops responding, or won’t open
http://support.apple.com/kb/ts1702
Contact the developer
If you see the issue again, contact the developer of the app for help:
Find the app in the App Store.
Tap the app and tap Reviews.
Tap App Support.
I hope this helps,
-Joe

Prevent a user from changing the Project ID in P6 EPPM 8.3.7

Does anyone know if there is a Global or Project Security Profile privilege that will prevent a user from changing the Project ID on an existing Project? We are using Primavera P6 EPPM 8.3.7
Thank you,
Eric

Hi,
Below project security profile may help you,
Edit Project Details Except Costs/Financials
Determines whether the profile will enable users to edit fields in General, Dates, Defaults, Resources, and Settings tabs in Project Details. To assign a project baselines, users must also have the "Assign Project Baselines" project privilege assigned to their profile.
Regards,
Marcos

Restrict Local Administrators from change Network property

In my office Environment we are using Development machines on which every developer has Local Administrator rights on there system. We are using 2 Internet lines in which one line is fast speed and another one is slow one, due to slow internet speed on
second line some peoples manually change the Gateway IP and switch from slow to Fast one, to stop this we need to restrict those users from changing IP on windows 7. Only domain Administrator can able to change that Setting. we are using Window Server 2008
R2 as ADDS. is there any way to stop this using domain group Policy? or Local security policy?

Hi Siddheshrsawant,
Sorry, we can’t restrict local administrators from changing network property via Group Policy, and this is by design.
For confirmation, the following thread also focused on the similar issue and can be referred to for information.
Unable to lock down Network Connections settings with Group Policy
http://social.technet.microsoft.com/Forums/windowsserver/en-US/32045ab3-0496-4f5e-b2c2-71ba0f2ed073/unable-to-lock-down-network-connections-settings-with-group-policy?forum=winserverGP
Best regards,
Frank Shen

Keep changing root password, keeps telling me password is wrong in terminal.

I used the migration tool to copy my documents over from my PC, but it created a separate user account. I want to move those files to my current account, but I don't have permission to access the folder unless I'm logged into that account (in which case I don't have access to the folder I want to move them to). I tried to change the folder permissions, but it said my root user password was incorrect. I changed it, got no error in doing so, and tried again. Still got the error. I found a thread with a similar problem (but not the same one) and followed the instructions in it. Still got the same error. How can I fix this?

In the title of this thread you list "keeps telling me password is wrong in terminal"???
When you open terminal have you tried the command, without the quotes "dsenableroot"? You must be logged in as a local admin to do this.
If you try this, terminal will ask you for your admin account password then you can enter a new password for root and verify the new password. Exit terminal Log out and log back in with username root and the password you put in for the root account when you were in terminal.
There is a definite problem, or actually a couple of problems, with the directory utility when trying to enable root from directory Utility / edit. Going the dsenableroot in terminal clears these problems out.

Changing Root password in HP-UNIX will affect any R/3 servers

Hi,
we are running R/3 on HP-Unix with Oracle as database and we would like to change the Root Password of UNIX for security reasons and would like to confirm changing the ROOT password will affect any SAP R/3 servers or will it change any of the parameters at OS level that will have affect on R/3.
Please do let me know what are the changes that will take place once we change the root password at OS level and R?3 level.
Regds,
Satyanarayana N.

Hi,
Hardcoded passwords into the scripts isn't a good practice, but if you're not sure about yours, go to the directory(es) where you have them (p.e. /usr/local/bin) and run
<i># grep <b>your_pwd</b> *.sh</i>
It must show you if there's this word into one of the shell scripts.
Best Regards,
JC Llanes.

[SOLVED] Need to change root password - current one doesn't work

Hey everybody,
Not sure where to put this, so I apologize if it's in the wrong forum.
I just installed Arch on my Dell netbook and all is well, except for issues with the root password. I am having a great deal of difficulty getting it to work. I know for a fact that I am typing it correctly. However, I did have trouble getting it set during the installation. When I try several times, I have gotten it to work, but I am getting tired of having to do that, and now I can't seem to get it to work at all. I have even tried a different keyboard, but with no luck.
Is there any way to change the root password short of a reinstall?
Thanks in advance for any help, but please keep in mind that I am relatively new to Linux and would greatly appreciate detailed instructions.
Jeff
Last edited by jlr1701 (2010-08-12 04:10:50)

Solved. Should anyone else have this issue, I solved it by entering this command:
sudo passwd root
I set a new password and it seems to work fine.
Didn't know if it was possible to change the root password that way, but glad it worked!

How to programmatically prevent a list from changing

Hi
I want to be able to add a trigger to a list that if the list is changed it will validate some conditions and prevent or allow the change to occur. I tried to raise form_trigger_failure from when-list-change but it doesn't work. Any ideas?

I want to be able to add a trigger to a list that if the list is changed it will validate some conditions and prevent or allow the change to occur. I tried to raise form_trigger_failure from when-list-change but it doesn't work. Any ideas?
Example for Emp Table dept Dept no
1.Make it as LIST
2. Item Trigger ->When-List-Changed
3.Put Bleow code which will check -if dept 10 is selected you will get below message
message('TRigger- When List Changed');
message('TRigger- When List Changed');
If :Deptno1=10 then
message('Deptno1= 10 is selected');
RAISE Form_Trigger_Failure;
End If;
IT will work

HT201304 iOS parental controls do not prevent the child from changing the device passcode.

So the parent cannot get into the device at all unless the child provides the passcode. Sure, the device can be taken away until the child provides the passcode, but why don't parental controls just prevent the passcode from being changed? Either that, or the parental control passcode should allow the parent to get into the device, over-riding the passcode lock.

We are not Apple iOS programmers. Just device users like yourself.
feedback.apple.com is where you should send suggestions.

Can not change root password for WCS

Need to change the root password for the web gui.
WCS is running on linux, i have tried to do the passwd user-root but it cames back saying it can not find the username.

Alex
You could use the recovering password procedure for wcs as a workaround (chapter 14 of the following link http://www.cisco.com/en/US/docs/wireless/wcs/7.0/configuration/guide/WCS70cg.html )
Recovering the WCS Password
You can change the WCS application root user or FTP user password. This option provides a safeguard if you lose the root password. An executable was added to the installer /bin directory (passwd.bat for Windows and passwd.sh for Linux). Follow these steps to recover the passwords and regain access to WCS. For password recovery on a wireless location device, refer to chapters 8 or 9 of the Cisco 2700 Series Location Appliance Configuration Guide.
Note If you are a Linux user, you must be the root user to run the command.
Step 1 Change to the WCS bin folder.
Step 2 Perform one of the following:
Enter passwd root-user newpassword to change the WCS root password. The newpassword is the root login password you choose.
or
Enter passwd location-ftp-user newuser newpassword to change the FTP user and password. The newuser and newpassword are the FTP user and password you choose.
Step 3 The following options are available with these commands:
•-q — to quiet the output
•-pause — to pause before exiting
•-gui — to switch to the graphical user interface
•-force — to skip prompting for configuration
Step 4 Start WCS.

Create local admin from workgroup manager

Just wondering if there is a way to create a local admin on a 10.6 MacBook using Snow Leopard server in the Workgroup Manager?

SL Server

X6270 change root password in preboot menu

Hi, I try to change password how write in official manual http://docs.oracle.com/cd/E19474-01/E21604-02/troubleshoot_recovery.html#50458662_48218 but I can`t give Accessing the Preboot Menu. Can you write all step by step? I plug console cable in SER MGT port run commad "reset /CH/BLn/SP", then I plug cable with *3-Cable Dongle II* (like this http://docs.oracle.com/cd/E19474-01/E21604-02/intro.html#50458659_60545) & see hot to blade boot. But I can`t see The ILOM Preboot Menu

Hi.
After you type command reset .... and press button, you should push this button and wait preboot menu on display.
Possbily, more easy way - Connect dongle with monitor to this blade. Remove Blade from chassii ( not fully). Install blade again and immedeately push button "locator" and wait.
Regards.

Remove Local System from Change The System Time

Hello,
Is there any way to remove the Local Service account from policy "Change the system time"?
I created a policy to only give permission for the Administrators and Power Users group, but when I run the AccessChk tool, the result is:
administrators
Power Users
Local System
Regards

> Is there any way to remove the Local Service account from policy "Change
> the system time"?
No. Local System is the "godfather of your computer" and cannot be
restricted.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Preventing local admin from changing root password

Similar Messages

Maybe you are looking for