{"id":41050,"date":"2017-05-23T13:44:05","date_gmt":"2017-05-23T18:44:05","guid":{"rendered":"https:\/\/eshop.macsales.com\/blog\/?p=41050"},"modified":"2017-05-24T11:22:01","modified_gmt":"2017-05-24T16:22:01","slug":"how-to-grant-administrative-access-to-locked-preference-panes-for-any-user","status":"publish","type":"post","link":"https:\/\/eshop.macsales.com\/blog\/41050-how-to-grant-administrative-access-to-locked-preference-panes-for-any-user\/","title":{"rendered":"How to Grant Administrative Access to Locked Preference Panes for Any User"},"content":{"rendered":"

Are you the designated IT person for your family, or maybe for your small business? If you are, then perhaps you’re getting a bit tired of everyone asking you to provide your administrator name and password every time a printer jams, an app needs updating, or Time Machine throws an error code.<\/p>\n

The Mac has a pretty straightforward model for assigning privileges to a user’s account, and in many cases, only the administrator has the right to stop, start, or pause services, such as pausing the print server when a printer jams. Only a user with administrator privileges can get the print server running again.<\/p>\n

\"\"<\/a>
(The print server always seems to enter a paused state when an administrator isn’t around to kick start it.)<\/strong><\/figcaption><\/figure>\n

If you’re tired of running over to a user’s Mac just to enter a password so the print server can restart after a paper jam, then you may be thinking it’s time to give everyone admin privileges. And believe it or not, that may be a valid solution to the problem, depending on the competence and trustworthiness of your users.<\/p>\n

It is, in fact, the method we use; all users at our home and office are set up as administrators, relieving us of the more mundane tasks of Mac administration. But if you’re inclined to use the standard, managed, and administrator user models to ensure a bit tighter security, then this tip can help you keep your personal workload low, while allowing other users to perform routine tasks, such as resetting printers, without needing the local overlord to make an appearance.<\/p>\n

Mac User Accounts<\/strong>
\nThe first account created during the original setup of your Mac is an administrator account that includes elevated privilege levels that allow the account holder to manage the basic system. The Mac’s administrator account isn’t an all-powerful tyrant; it has a number of restrictions, including the inability to access another user’s data. It does, however, have power over all of the Mac’s system preferences, including the ability to add new apps, add new users, assign user groups, manage parental controls, set up accessibility options, and manage printers. You get the idea. If there’s a system preference pane for a service, users holding an administrator account can make changes as they see fit.<\/p>\n

\"\"<\/a>
(Some system preferences are restricted to those with administrator accounts, which can prevent Standard users from fixing common problems.)<\/strong><\/figcaption><\/figure>\n

While the administrator is one type of account, the Mac OS supports additional types, including:<\/p>\n

Standard:<\/strong> Standard user accounts can install apps and change settings that affect only their own accounts. So, standard users can pick their own desktop wallpaper, customize the Dock, and set their own preference for how a mouse or track pad works. They can’t add or delete users, or change settings that would affect anyone else.<\/p>\n

Managed:<\/strong> Managed users are bound by the restrictions set up by Parental Controls. With Parental Controls, you can restrict the apps available, the websites that can be visited, and the contacts available to the user through various apps, such as Messages and Mail. Managed users can also have usage restrictions based on time, to ensure kids aren’t using their Macs when they should be sleeping.<\/p>\n

Sharing Only:<\/strong> Allows users to log in remotely and access their own files. It doesn’t allow general access to the Mac, or the ability to change any settings.<\/p>\n

Guest:<\/strong> Guest user accounts are for visiting family, friends, or clients who may need to use your Mac for a brief time, perhaps to check messages or access a website. All of a guest user’s data stored on the Mac is deleted automatically when the user signs out.<\/p>\n

Add Additional Administrators<\/strong>
\nOne method to help resolve the burden of administration is to spread the task around, allowing other trusted users to share the work. In general, this is a good idea; having a single administrator can cause problems if the administrator isn’t available when some task comes up that needs the admin password.<\/p>\n

\"\"<\/a>
(Standard and Managed users can have their privilege levels elevated to allow them to administer the computer.)<\/strong><\/figcaption><\/figure>\n

The first step is to use the Mac OS Users & Groups preference pane to change the account type for the selected individual. In this example, you can change a standard user to an administrator.<\/p>\n

Of course, you must already be an administrator for this to work.<\/p>\n

If you’re not currently logged in to your administrator account, log out, and then log back in with the appropriate account.<\/p>\n

Launch System Preferences by clicking its Dock icon, or by selecting System Preferences from the Apple menu.<\/p>\n

In the System Preferences window, open the Users & Groups preference pane.<\/p>\n

Click the padlock icon in the lower left corner, and then enter your administrator password. Click the Unlock button.<\/p>\n

Select the user account you wish to elevate to an administrator account from the sidebar list.<\/p>\n

Place a checkmark in the “Allow user to administer this computer” box.<\/p>\n

Note:<\/em> If the account you wish to elevate is a managed user account, all parental control settings will be removed when the user is elevated to an administrator account.<\/p>\n

Provide Admin Privileges for Specific Tasks<\/strong>
\nA slightly different approach is to provide admin-like capabilities to standard users, but restrict them to certain tasks. This is the way we fixed one of our headaches: clearing printer jams that cause the print server to pause. By giving all standard users admin rights to the Printer preference pane and print server, they can be their own printer administrator.<\/p>\n

This same concept of limited administrator rights works for a number of system preference panes, including:<\/p>\n