Administration and user accounts

[Eusebius]

I'm a current Microsoft Windows user who is about to switch to mac. In my pre-purchase research I've run across the issue of establishing administrator accounts on OS X. I'm a bit confused over the advice given.

There's this: "By default, the account created when installing OS X is an Administrator account which has the equivalent of "root" access. It's not secure or necessary to use that account for routine work. While logged in as the administrator, use the "Accounts" System Preference tool to create a non-administrator user account and give it a different password. Then, use the user account for daily tasks."

And then there is this: "...set up the first account (the default one you start with) with everything you want to use on a daily basis (like mail etc) that uses already installed software. This account will be an Admin account.
When you've got it the way you want it, go into Prefs > Accounts and make a new account called Admin (or whatever) and give it a different password. Check the box on that account that says "allow this user to administer". This is now an Admin account too. It helps to "enable Fast User Switching" at this point also. Log into the new account just to check it's working.
Go back to your original account and UN-check that same 'allow this user..' box on your day to day account. This is now no longer an admin account."

The second variant, which is from this forum, seems more complicated than the first. What are the advantages to each of these procedures?

Do I need to bother with this user account business at all? I plan to buy a non-portable imac; it will be for home use; I will be its only user (single household....).

Thanks for any help on this.

 

[Queso]

You should always use your computer (whether Mac/UNIX or Windows) with the least amount of rights you need so setting up a separate admin account is one of the best security measures you can take. The second method you've quoted is the easiest way to do it on OSX, but it will end up with the user-level account staying as the owner of all the installed software in Applications, so it's less secure than the first method.

Running OSX for day-to-day tasks with an admin-level account doesn't really leave you more open to something nasty getting into your system since both require you to enter your password for installations, but if something does get in it will be able to do a lot more damage than if you were running as a user-level account. So far nothing has really taken advantage of of this, but you can't rely on it staying that way forever.

On a clean system, do it the first way.

 

[emptyCup]

There's this: "By default, the account created when installing OS X is an Administrator account which has the equivalent of "root" access.

Equivalent in the sense that an Administrator can install and remove things but not in the sense that you are actually running as root or that processes can install other processes without you knowing. Obviously it is safer to work from an account using the least privileges necessary. And, unlike Windows where some programs won't work if they are not root, everything works reliable on a Mac in a non-Administrator account.

However, for convenience, many of us work from Administrator accounts without problems. If that changes so will I, but so far I haven't heard of any problems. Turn on the Firewall under System Preferences > Sharing. Don't turn on any services you don't need (they're all off by default) and turn off "Open safe files..." and Auto Fill in Safari (if you use it). You should be fine with that.

If other people, say your children, are going to use your machine make them a separate non-administrator account with just those things you want them to have. That way the can not mess up any of your work.

 

[mkrishnan]

As for the difference between the two methods, the primary difference is just that the forum method allows you to make changes to your account that need admin privileges to be easily made before you de-admin yourself. You can always promote / demote admin privileges for an account at any time.

So if you don't have any special things on your to-do list that require setting up your account while having admin privileges, the simpler method is just fine.

 

[Eusebius]

Thanks for the prompt replies. I'll start with the simpler method. As I browse this and other sites and handle the computer in the shop, I really look forward switching to os x and the imac.