Manage User Accounts

You can create as many user accounts on your Mac as you want, providing each user with their own home folder where they can put their files, and allowing them to customize their environment individually. You can also manage these accounts, giving users specific rights, such as which applications they can use and which functions they can access. For example, you can set some accounts to provide full access to all applications, and you can configure other accounts so specific users can only use selected applications.

To create and manage user accounts, you must be an administrator. An administrator is a user who has the right to create, edit, and delete user accounts, as well as install software and perform certain system maintenance tasks. If you are the first user on your Mac, you are automatically an administrator. While each Mac must have at least one administrator, you can allow several users to be administrators, or even all users if you wish. You can choose this when creating or editing user accounts (see the following section).

You manage user accounts in the System Preferences. You can open the System Preferences application by clicking its icon in the Dock, or by selecting Apple Menu | System Preferences. Click the Accounts icon in the System section of the System Preferences; this opens the Accounts preference pane (see Figure 8-3).

Figure 8-3: You create, edit, manage, and delete user accounts from the Accounts preference pane.

The left column of the Accounts pane displays all the users on your Mac. You can see in Figure 8-3 that the top of this column is labeled My Account, and beneath this is a section labeled Other Accounts, that shows all the other user accounts on your Mac. This preference pane is where you can add new users, edit or delete existing users, and set login options.

Create User Accounts

To create a new user account, click the plus (+) button below the user account list. This displays a new user account in the accounts list; initially this is just labeled “Standard,” until you enter a user name.

There are four tabs for entering information about a user: Password, Picture, Security, and Limitations. The only one you have to fill in is the Password tab, where you must enter the following information (see Figure 8-4):

Figure 8-4: Here’s a new user’s account information filled in.

• Name Enter the user’s real name.

• Short Name This is the name that appears on your user’s home folder, and is also a name your user can enter when logging in to your Mac remotely; they don’t need to use their full name. Your Mac will suggest a short name here; in most cases, this is just the user’s name in lowercase letters. You can change this if you don’t like the suggestion. You might want to do this if the short name is too long.

• Password This is your user’s password. It must be at least four characters long, and is case sensitive. (This means that capitals count; “PassWord” is not the same as “password”.) If you are in a company or school, use a password that’s hard to figure out; computer security professionals tell you to use something with random letters and numbers. But if you’re using your Mac at home, use something that you’ll never forget. Don’t worry too much about security in such a case.

• Verify Enter the password again to confirm it.

• Password Hint This is optional, but is useful if you think your user may forget their password. Enter a hint that will help them remember the password. This hint is displayed if the user enters a wrong password three times. Try to choose a hint that’s not too obvious a giveaway for your password. If you do use your spouse’s name, your child’s name, or your pet’s name as a password—which is not a good idea—don’t use a hint such as “my wife’s name.” Someone might be able to figure it out. If you only use your Mac at home, though, don’t worry too much about this.

When you’ve filled in all the preceding information, your user account is ready to be created. But it’s not actually created yet. There’s no Save button; the account is created when you click another user in the Accounts list, when you click another tab in the Accounts preference pane, or when you exit the System Preferences or the Accounts pane.

If you want to change the user’s picture—which is displayed in the Login window—click the Picture tab. Choose from one of Apple’s pictures, or choose your own by clicking Edit..., then Choose..., and navigating to a picture file. You can also just drag a picture file from the Finder to the Images box, which displays when you click Edit... You can change the scale of the picture by moving the slider below it, and then, when you’ve finished, click Set to use the picture.

The Security tab lets you choose two options: the first is FileVault encryption for the user’s home folder. (See Chapter 19 for an explanation of how to use FileVault.) The other option, Allow User To Administer this Computer, gives the user administrative access. If you check this, the user will have rights to create and manage users, to install software, to change all the system preferences, and to perform certain other tasks that regular users cannot perform.

Did you know? Use Administrator Accounts

As you've seen, there are two types of user accounts: administrators, who can do just about anything on your Mac, and standard users, who have limited access to files, folders, and settings. It's important to understand what an administrator account allows you to do, and what limits it has.

As the administrator of your Mac, you have access to all the System Preferences, and you can change settings that affect the overall operation of your computer. Standard users can only change settings that affect their environments and the way they work. Administrators can also install software, using Apple's Installer program, which standard users cannot do. Finally, administrators can access files and folders in the netherworld of their Mac, including those in the System and Library folders (see Chapter 5 for a discussion of these folders). The Finder displays an authentication dialog when you attempt to access these files and folders, and if you enter your administrator user name and password, you'll be allowed to continue.

One thing administrators cannot access, however, is other users' files contained in their home folders. These files, as long as they are not in the Public or Sites subfolders, are only accessible to their creators. (Administrators, however, can turn on special root access to be able to go anywhere they want—but that's beyond the scope of this book.)

While you need to be an administrator to do certain tasks, this power can be dangerous. In fact, many users find it safer to create two accounts for themselves: an administrator account for installing software or changing system-wide settings, and a standard account for everyday use. Even if you're careful, it's always possible that, as an administrator, you might accidentally delete important files or make changes that cause problems to your Mac.

In fact, if you work with two accounts, you'll rarely need to log in with your administrator account. To access any of the System Preferences that standard users can't change, just click the Lock button, and then authenticate by entering your administrator account user name and password. When installing software, authenticate this way as well. While you'll type your user name and password a bit more often, it will ensure that you can't make any blunders as an administrator.

Set User Limitations

After you set up a user account, you can establish limitations, restricting what they can do and which applications they can access. To do this, click a user’s name in the Accounts list to select it, and then click the Limitations tab.

This offers three choices: No Limits, Some Limits, and Simple Finder, each of which is described next.

• No Limits This is what it says; there are no limits as to what the user can do, with the exception of whether the user is an administrator or not.

• Some Limits This lets you choose from a number of actions that you might want to disallow the user to perform, such as Open All System Preferences, Modify the Dock, Change Password, and Burn CDs and DVDs. It also lets you limit their usage to selected applications. To do this, check This User Can Only Use These Applications. Check or uncheck the boxes next to the four categories: Applications, Utilities, Applications (Mac OS 9), or Others. To allow or disallow access to specific applications, click the disclosure triangle to show all the applications and uncheck the ones you don’t want your user to use. You can uncheck any applications to prevent users from launching them, and check applications to allow them, effectively creating user accounts that can only use one or two applications if you want.

  

• Simple Finder This presents a simplified Finder to the user. It offers fewer menu choices, and gives the user fewer chances to mess things up. You can choose, as for the Some Limits setting, which applications you want them to use, and these applications appear in the My Applications folder in the Dock. This can be a good way to configure access to your Mac for a young child, only allowing them to launch games they play, and preventing them from fiddling with any other programs.

  

The Simple Finder is a truly simplified interface, and one that is entirely kid-safe. As you can see in Figure 8-5, a minimal Dock is displayed (with just three folders), and Finder windows are as Spartan as possible. The three folders are, from left to right, My Applications, which contains aliases to the applications the user is allowed to use, Documents, which contains any documents the user creates, and Shared, which allows you to provide documents to the user. These items display as icons in the Simple Finder window, and only one window displays at a time.

Figure 8-5: The Simple Finder: in the Dock, the three folders are My Applications, Documents, and Shared.