Section 117. About Administrative Responsibilities

117. About Administrative Responsibilities

There are two kinds of users in Mac OS X: standard users and Admin users (or administrators ). Standard users have limited capabilities; they cannot change global preferences for the computer, modify system files or hardware settings, or install applications. (They can, however, read and burn CDs, play games , and do many other things that require ordinary hardware access.) Admin users, however, have total control over the system's behavior and can change anything they want.

KEY TERM

Admin user A type of user who is granted the capabilities to change global settings, install applications, and make other changes to the behavior of the entire system.

The first account that was created on your computer, at the time when you first started it up, is an Admin user; unless you have created any other users, this is the account you're using now. You can also grant Admin status to standard users, or revoke it from other Admin users.

The power associated with an Admin user account naturally brings with it the responsibility to use that power wisely, which means using it only where necessary; because an Admin user is capable of changing system files and global settings that a standard user can't modify, such a user also has the potential to wreck the entire system by deleting critical files or mangling system settings. For this reason alone, it's generally desirable to make sure that unless they specifically need to be able to change system settings or install applications, new user accounts that you create (for members of your family or employees at your workplace) are standard user accounts. This greatly reduces the chance that anything will get broken through daily use. (On the other hand, it means you won't have anyone else to blame if anything does go wrong )

Under some circumstances, giving up Admin power for the sake of safety during daily computing is an acceptable tradeoff . You might have a public computer in your living room that anybody can use, for instance; on this computer, you might have a single Admin account that you use only on those rare occasions when you need to install new software or update Mac OS X, and several other accountsstandard accountsfor each of the other members of the household to run their applications and store their personal files.

However, because of the way Mac OS X is designed, it's generally safe to use the computer routinely no matter what kind of account you use. The reason for this is that Mac OS X's security architecture allows any usereven a standard userto accomplish administrative tasks , provided that that user has the name and password of an Admin user. Mac OS X prompts for this information, in what is known as authentication , whenever a user tries to perform a task that requires administrative power (such as changing a global system setting, deleting a file owned by another user, or shutting down while other users are logged in). Thus, as long as there's at least one Admin account on the computer, you can create a standard account for each of the computer's users and even yourself to use on a routine basis, and still be able to accomplish Admin tasks using that account.

You are prompted to authenticate as an Admin user when you attempt to perform certain tasks.

KEY TERM

Authentication When you enter the name and password for an Admin user, you're authenticating as an administrator. If you do so correctly, the system lets you perform a requested administrator-level task. Authentication is usually triggered by clicking a "lock" icon whose appearance ("locked" or "unlocked") indicates whether changes are allowed or prevented. This icon appears in many System Preferences panes.

NOTE

After you authenticate for any secure task, you have five minutes of free administrative capability (you can issue any new commands that you want without entering your password again) before Mac OS X will again require authentication. Note that this does not apply to moving files that you don't own in the Finder; these operations require authentication on a case-by-case basis.

Similarly, even Admin users must authenticate before certain actions will be executed. The reason for this is that the system must ensure that it's actually a user with Admin privileges requesting the action, not just some random person who sat down at the computer while the real Admin user was away. Admin users can directly manipulate system files (in the global Library folder, for example) and change all System Preferences without authenticating, but they must enter their passwords at other critical times, such as when installing new system software. Thus the dangers inherent in routinely working as an Admin user are mitigated, and you generally won't have to worry if your Mac has only a single user account on it, an Admin account, which you use every day.

TIP

The security-conscious Mac user might want to extend Mac OS X's cautiousness about installing system software and overriding file ownership to cover the System Preferences as well. Open the Security Preferences (click Security in the System Preferences ), and select the Require password to unlock each secure system preference check box. With this option selected, every time you want to modify any of the locked Preference panes, you will need to click the lock icon in the lower-left corner of the System Preferences window to authenticate as an Admin user.

If you create additional user accounts, create them as standard user accounts, unless you want the other users to have the same administrative powers that you do. This ensures that while they must rely on you to install new applications or keep the system updated, you're also the only one who can really do any damage to the computer; others can use the system free of worry, leaving the administrative tasks in your capable hands. Aside from the security and privacy benefits discussed earlier in this chapter, having multiple users on a Mac also makes a system a lot easier to administer and keep organized. Particularly thanks to the division of privileges between standard users and Admin users, you can tightly control what kind of important actions take place in the computer, while giving each of your users the freedom to use it according to their own tastes and preferences.

NOTE

Standard users can change their own full names , passwords, and login pictures. They can't, however, change any other user's information.

If you are the system administrator, you can create, delete, and modify all the other user accounts from your own Admin account, including their passwords and login pictures (which appear in the login window and in the Fast User Switching menu). All this functionality occurs in the Accounts Preferences pane.