Stop users changing administrator password

[lmkc]

Hey guys,

I work in a company where we lend out Macbooks. The 'lendee' gets their own administrator account made and there is a second "company" administrator account.

The company account is to push out updates over the internet, give the IT Department something to use if it needs repair, password recovery etc.

So we have two administrator accounts, is there a way to stop other administrators changing passwords? I don't know why (paranoia, lack of technical knowledge) but we always have people changing (or deleting) the company account.

I noticed in Yosemite that you could make a account with a apple ID - and I thought that maybe you had to provide security questions to change it - but you can change it to anything you want afterwards with barely a wink.

Does anyone know how to keep administrator accounts... separate, I suppose? Surely this has to happen in families. You'd want your kids to be able to update software download games and podcasts etc.

 

[Taz Mangus]

Hey guys,

I work in a company where we lend out Macbooks. The 'lendee' gets their own administrator account made and there is a second "company" administrator account.

The company account is to push out updates over the internet, give the IT Department something to use if it needs repair, password recovery etc.

So we have two administrator accounts, is there a way to stop other administrators changing passwords? I don't know why (paranoia, lack of technical knowledge) but we always have people changing (or deleting) the company account.

I noticed in Yosemite that you could make a account with a apple ID - and I thought that maybe you had to provide security questions to change it - but you can change it to anything you want afterwards with barely a wink.

Does anyone know how to keep administrator accounts... separate, I suppose? Surely this has to happen in families. You'd want your kids to be able to update software download games and podcasts etc.

Usually you have a single admin account and the other accounts are standard user or a managed user. This way the updates are controller through the admin account. It would kind of defect the purpose of having an admin account if you could not have the ability to change the admin user password.

In my case, the kids have standard user accounts and they are not allowed to do any updates without my knowledge. That is why they don't have an admin account.