Admin vs. Standard User // apps from Anywhere

-paradox- said:

I have kind of an annoying problem regarding my standard user:
I've of course set SECURITY/GENERAL to open apps from anywhere (for both: standard user as well as admin), but everytime I open up a program that's not from the appstore, OSX would ask me again if I'm sure I want to open it, then I have to enter the Admin's username + password.
I've also tried opening all the apps from my admin account first, because I thought that maybe this way the rights to open programs get somehow transfered to the standard user account as an "ok app", but that didn't do it

Click to expand...

Just curious. Why are you running a standard account, instead of just using the admin account? There's no real-world advantage to running a standard account.

-paradox- said:

The problem is, that I have assistants working on my machine as well and I don't want them to have admin rights.
But maybe I'll just have to change their standard to an admin account that asks for a password for everything they do.
But then I'll run into new problems: they wouldn't have to enter any password at login so basically everyone can access the system plus they won't be able to copy things to the desktop (because OSX will ask for a password each time they try it).

I didn't think this was a bug just some setting I didn't know about...but seems like it really is a bug

Click to expand...

Actually, it would be better if you set up an admin account for yourself, and standard accounts for each of your assistants, each account with its own password. If you want to share documents between users, use the Shared folder, not the desktop.

-paradox- said:

It's really just about the fact that programs from "anywhere" can't be launched as a standard user without entering an admin password.
When you download some program from the internet, OSX will ask, if you're sure, you want to open it. Then you click "allow" and OSX remembers your decision and will never ask you again, but this doesn't seem to work with standard users. OSX doesn't remember your decision.

Click to expand...

I'll have to do some checking on this. I haven't run a standard user account in quite a while.

My Admin account is set to "Allow apps downloaded from: Mac App Store and identified developers". Some of the apps I have installed required me to "Allow anyway", since they were not from identified developers. I just created a Standard user account on my Mac and logged in. I launched several such apps that were not installed from the App Store and not from identified developers. I didn't get one request for an admin password to open such apps. The standard account inherited the same setting from my admin account, namely "Allow apps downloaded from: Mac App Store and identified developers".

-paradox- said:

Hmm...that is weird...
Thanks for testing it!
I created a new test account, because I thought that maybe there's a problem with apps that have been installed after the standard user was created, but that didn't help.
Could it be that it depends on the program?
I just found out that e.g. mucommander and cyberduck don't ask if I'm sure I want to open them, whereas VLC player and MPEG streamclip do.
Many thanks!

Click to expand...

Check the security settings on the standard account to see what apps they allow. VLC player is one of the apps I tested with, and it did not ask for a password.

I did some more testing. I changed the security settings on the admin account to only allow apps from the Mac App Store. When I logged into a standard account, that change was reflected there. I also created a new standard account, and the settings matched. So if you create standard accounts, their security settings for which apps they allow will match those of the admin account that created them. I would leave the settings to "Allow apps downloaded from: Mac App Store and identified developers".

Even with the setting allowing Mac App Store only, I was able to launch all the apps on the standard accounts without being asked for a password. These apps included VLC player, Air Parrot, Skype, Audacity, Plex, Transmission and several others, none of which were installed from the Mac App Store.

-paradox- said:

But do you get asked if you're sure you want to open those programs everytime? Or just once when you open them for the first time?

Click to expand...

They opened the first time without asking any kind of permission.

-paradox- said:

Hi!
Just wanted to thank you for your help. Even though it's still not working for me
Don't have any idea why...

Click to expand...

You can remove the extended attribute com.apple.quarantine from the application via the command line:

http://terminal.pearsall.co/2014/07/remove-quarantine-flag-from-mac.html

-paradox- said:

Cool! Thanks so much!
But do you have any idea why it's happening only on my sytstem, not on GGJstudios' for example?
I just set up my mac from scratch a month ago (new mac; partioned my HDD and installed mavericks on both partitions).

Click to expand...

I am not sure what causes this behaviour. I had a similar issue like you once, that was caused by a unfortunate combination of flags (uchg) and extended attributes on the folder where the app was installed http://hints.macworld.com/article.php?story=20031017061722471

I usually run all my accounts as the standard user and also do all the system maintenance from there. It usually 'just works'.