News, info, and opinion by Mac users, for Mac users.

September 25, 2006

security

How-To: Switch your account to a user account

Posted Sep. 25, ’06, 5:32 AM PT by Derik DeLong
Category | Security

New Account The recent Installer package problem reinforces the idea that administrator accounts shouldn’t be used for everyday activities. In the case of the Leap-A virus, its effects were mitigated if run as a user because it had no access to the Applications folder to infect applications.

Even if Apple fixes the above mentioned problem, the bottom line is still that users should not run as admin if it can be helped. In Windows, you’re likely to run into issues trying to run many programs as a limited user. This isn’t true with Mac OS X user accounts. Here’s how you do it with minimal impact.

  1. Go to Accounts in System Preferences.

  2. Create a new administrator account. When setting up this account, don’t use “admin” as the username, particularly if you enable services that can be accessed from the internet. It increases the chances someone will be able to brute force attack into your administrator account. Also choose a very strong password (upper and lower case with numbers) that you can remember. You can leave Automatic Login on for your current user if you wish.

  3. Uncheck the “Allow user to administer this computer” checkbox for your account.

That’s it! Make sure you remember the password for your administrator account. Chances are you may never have to log into that account. If you need administrator privileges (generally for installers and moving applications into Applications), Mac OS X will prompt you. Type in your administrator username and its password. This works from within your user account.

Congratulations. You’re one step closer to safer computing.


3 Comments

Tim Author Profile Page said:

I'm sorry, but I'm confused. (what else is new) Right now, I'm running my system under my only account, obviously an admin account. So I should create another admin account, but don't check the use admin etc. box? Then login using that account?

September 25, 2006 10:27 AM
Derik Author Profile Page said:

What you want to do is create another administrator account and then demote your own account so that it no longer has admin capabilities.

That way, you keep using the account you have right now, but with reduced risk.

September 25, 2006 10:53 AM
jj said:

While you are discussing accounts, is there any easy to way to copy or clone an existing account. I have a separate admin account and a "family" account that we all use, with the dock and other interface items set up how I want them. I would like to clone this into separate accounts for my kids, to which I would add parental controls. I would like their accounts to start with the same dock, etc. Suggestions?

September 26, 2006 7:07 AM

Leave a comment

 



Visit other IDG sites: