Parental control restrictions

[Beachguy]

I do not necessarily mean the parental controls in OS X, but control by a parent (me) in general.

I have a son who is challenging, to say the least. After putting parental controls in effect on the MacBook Pro he uses, I found he was on YouTube trying to find ways to get administrator privileges on the Mac. He found several videos on YouTube which purport to tell him how.

I want to block him from command line usage so he cannot try to circumvent the security and controls in place. How can I accomplish this?

 

[Beachguy]

Surely someone has some input as to how I can be sure the things I'm concerned about do not happen. Or is it a case that if he is set as a simple user he cannot do the things they claimed in the video on YouTube?

 

[Weaselboy]

I do not necessarily mean the parental controls in OS X, but control by a parent (me) in general.

I have a son who is challenging, to say the least. After putting parental controls in effect on the MacBook Pro he uses, I found he was on YouTube trying to find ways to get administrator privileges on the Mac. He found several videos on YouTube which purport to tell him how.

I want to block him from command line usage so he cannot try to circumvent the security and controls in place. How can I accomplish this?

Let me try and walk you through this.

First make an admin account for yourself then make a "standard" account for your son. Now while in the admin account go into the Parental controls section and configure his standard account with whatever Parental Control limits you want. Make sure your admin password is something long and complex enough he cannot guess it.

Then give him the standard account username and password.

Now for some background. With a newer Mac it is very easy to reset the admin password by booting into single user mode then resetting the password or by entering the Recovery HD partition like described here. If he is smart, about ten seconds on Google will lead him to the links I just gave you and many others like it.

Fortunately, there is a way to block this. What you want to do it set a EFI (firmware) password following the steps in this article. Again, make the password long and complex enough he cannot guess it. Make sure your write down this password somewhere because it CANNOT be recovered without taking the Mac to an Apple Store for a reset. Once you have set a EFI password it prevents anybody from booting to either the recovery partition or single user mode without that password, so you will have effectively blocked him from resetting the admin password.