Cant gain admin status.

[patrickgc]

Hello, having this problem that i cant gain administrator access, and i cant make any changes at all.

Here i am ( In danish ) trying to manage my power settings. i click the lock in the left bottom corner, and i get this menu where im asked to enter a name and a password. I dont got a administrator on my computer it appears, how do i deal with that? Login to my current user doesnt work.

Any suggestions?

 

[satcomer]

How to Reset a Lost Admin Password on Mac OS X

 

[Weaselboy]

Follow these steps to make a new admin account, then you can use that account to give your existing account admin rights.

Hold command-s when booting to get to single user mode.

At the command line that comes up type this in then return to mount the drive.

mount -uw /

Then type this in and hit return. This will cause the new system setup routine to run at the next boot.

rm /var/db/.AppleSetupDone

Now type reboot and the system will restart. When it starts you will get the new system setup process. Just go through that and setup an admin account. Call it temp or whatever because we will delete it later.

Now login to the new admin account the go to Users & Groups in System Preferences and select you old real account and give it admin rights.

Now reboot and login to you real account. Make sure it has admin right like you want and it if does, go back to User & Groups and delete the temp admin account we made.

 

[MacOG728893]

Follow these steps to make a new admin account, then you can use that account to give your existing account admin rights.

Hold command-s when booting to get to single user mode.

At the command line that comes up type this in then return to mount the drive.

mount -uw /

Then type this in and hit return. This will cause the new system setup routine to run at the next boot.

rm /var/db/.AppleSetupDone

Now type reboot and the system will restart. When it starts you will get the new system setup process. Just go through that and setup an admin account. Call it temp or whatever because we will delete it later.

Now login to the new admin account the go to Users & Groups in System Preferences and select you old real account and give it admin rights.

Now reboot and login to you real account. Make sure it has admin right like you want and it if does, go back to User & Groups and delete the temp admin account we made.

So if someone gains unlawful entry to a standard user because they guessed an easy password. Having a separate admin account with a secure password would make no difference because it can easily be removed or changed?

Is encryption the only means of protection?

 

[Weaselboy]

So if someone gains unlawful entry to a standard user because they guessed an easy password. Having a separate admin account with a secure password would make no difference because it can easily be removed or changed?

Is encryption the only means of protection?

Exactly. Apple has made it ridiculously easy to reset passwords if someone steals your Mac. Turning on Filevault encryption is definitely the way to go. I turn it on first thing with every Mac I buy.

 

[yjchua95]

Exactly. Apple has made it ridiculously easy to reset passwords if someone steals your Mac. Turning on Filevault encryption is definitely the way to go. I turn it on first thing with every Mac I buy.

FileVault and setting an EFI password would double it, because locking down the EFI would prevent someone from booting into single user mode too.

 

[Weaselboy]

FileVault and setting an EFI password would double it, because locking down the EFI would prevent someone from booting into single user mode too.

I use an EFI password just to make my Mac essentially a paperweight if it is stolen, but it is not really necessary to prevent single user mode since having FV2 on already does that.

 

[MacOG728893]

I use an EFI password just to make my Mac essentially a paperweight if it is stolen, but it is not really necessary to prevent single user mode since having FV2 on already does that.

In theory, if a Mac was in a business environment, what would one do? Use open or active directory with a network account or the equivalent of a domain controller?

 

[Weaselboy]

In theory, if a Mac was in a business environment, what would one do? Use open or active directory with a network account or the equivalent of a domain controller?

I'm not up to speed on how AD works with Macs, so can't comment. I think things would work the same as without FV on though since once you login the Mac works normally.

 

[MacOG728893]

I'm not up to speed on how AD works with Macs, so can't comment. I think things would work the same as without FV on though since once you login the Mac works normally.

What you're saying is that one could use single user mode to create an admin account even if the Mac was connected to a network account?

 

[Weaselboy]

What you're saying is that one could use single user mode to create an admin account even if the Mac was connected to a network account?

Yes, I don't see how having a networked account would stop one from entering single user mode and doing what I described earlier.

 

[chrfr]

What you're saying is that one could use single user mode to create an admin account even if the Mac was connected to a network account?

A network account doesn't obviate the need for encryption and a firmware password to keep eyes off the data on the disk.

 

[MacOG728893]

Yes, I don't see how having a networked account would stop one from entering single user mode and doing what I described earlier.

A network account doesn't obviate the need for encryption and a firmware password to keep eyes off the data on the disk.

I appreciate your responses. When you refer to EFI, are you talking about an HDD lock found on similar Windows BIOS motherboards or are we referring to Apple's activation lock with an Apple ID?

 

[chrfr]

I appreciate your responses. When you refer to EFI, are you talking about an HDD lock found on similar Windows BIOS motherboards or are we referring to Apple's activation lock with an Apple ID?

It's most like the BIOS lock. You can get what is effectively the equivalent of activation lock by enabling "find my Mac".

 

[MacOG728893]

It's most like the BIOS lock. You can get what is effectively the equivalent of activation lock by enabling "find my Mac".

So how do people deploy this on an enterprise level? Surely they don't distribute individual Apple ID's for each client. A master Apple ID?

 

[chrfr]

So how do people deploy this on an enterprise level? Surely they don't distribute individual Apple ID's for each client. A master Apple ID?

That's one way to do it.

 

[Weaselboy]

So how do people deploy this on an enterprise level? Surely they don't distribute individual Apple ID's for each client. A master Apple ID?

http://training.apple.com/osx

You can setup "profiles" so when an employee sets up their new Mac on the network it gets setup however the profile is configured. There is some material at this link on it. I don't know enough about it to say if a profile can force an EFI password or not.

I know you can buy "enterprise" licenses for apps.

Like chrfr said, the EFI (Extensible Firmware Interface) performs the function of the old PC BIOS.