Semi Admin User Account

[bjf123]

Got a problem that I don't think we can solve. We have a number of Mac minis that we are planning to use in our plant. We have them configured with an Admin user and a Standard user that we've restricted to being only able to run the programs required in the plant. We have a new program we need to add for use in the plant, but it seems that it will only run under an Admin account, which we don't want. Is there any way to have an Admin account have restrictions applied to it? I'm guessing no, since an Admin is supposed to be able to do anything. We haven't been able to figure out a way to do it. We've tried running the program under the Standard user account and saying Always Allow to the popup that appears when we try to run it. Keying in the Admin user name and password doesn't matter. It still won't run.

 

[doynton]

What is the program?

 

[bjf123]

It's a niche program from HP used to connect digital presses with a Dell server that houses the artwork being printed. We've been talking with the software people and they say it should work, but we can't get it going unless it's running under an Admin account.

e try to limit the access the users have on those Macs to keep them from streaming music or watching You Tube on them. That's why we wanted to set up parental controls under a standard user account.

 

[campyguy]

We do have two apps that "like" admin accounts, and it's kind of annoying. I take three measures to keep my employees (and me!) focused on the tasks at hand while using those Macs...

First, is I took some time to set up some Rules in Little Snitch, which tells me almost everything - I've set up a group of Rules that I can backup and import to other Macs. And, one can "lock it down" and set up Network Profiles (like if one needs to take a Mac off a network and put it on another, for maintenance and the like). Little Snitch also has flexible licensing, and I have several licenses - it's on all of my Macs. I block all of the non-essential inbound services, and my employees stay focused.

Second, set up a second partition and install just your needed apps on that partition, and I've "hidden" Safari and Messages with custom icons - the user of that Mac would need to go to some lengths to use internet-based services.

Third, you need some self control. No, seriously! Check out the SelfControl application - https://selfcontrolapp.com/ - it's been around for several years, and two of my friends use it in their company. There's several helpful YouTube videos how to manage the app, and the app has many canned services to manage.

 

[bjf123]

It looks like we are able to get it working under a standard account, but can't block access to Safari and a few other programs. We've removed them from the dock and put a Hosts file in place that blocks sites like Pandora, ESPN, YouTube, etc. if someone is really wanted to get around it, they could, but most of the users are not that technologically savvy.