using one account as both an admin and a standard user

[gaussian]

Hi,

I'm new to mac and am getting a MBP and am deciding what to do about standard users/admins (e.g. whether to have my main account be an admin or not). I have two questions:

1. Does it harm anything to toggle on/off the "allow user to administer this computer" button several (or many) times over a period of time? (That is, are there lower level system files that might get mucked up?)

This is in case I'm indecisive and go back & forth, and also very relevant for:

2. Would it be reasonable to have an admin account plus my main account, but when I needed to do admin tasks that required me to actually login to an admin account, I toggled the "allow user to administer . . ." button for my main account (and so "did everything" from there instead of performing any tasks in the admin account)? [I realize that I'd have to go to the dedicated admin account to toggle the option off again.]

The reason I ask is that it sounds like there are some admin things that should really be done or can only be done in an admin account (instead of with spot admin authorization) and I'd like to be able to do these things from my main account (for convenience; so I could multitask; so I wouldn't have to worry about getting any settings in the admin account setup as I wouldn't really use it; to "get the best of both worlds"; etc).

Thanks!

 

[sfisher]

1. Does it harm anything to toggle on/off the "allow user to administer this computer" button several (or many) times over a period of time? (That is, are there lower level system files that might get mucked up?)

I do not see any reason why this would hurt anything.

2. Would it be reasonable to have an admin account plus my main account, but when I needed to do admin tasks that required me to actually login to an admin account, I toggled the "allow user to administer . . ." button for my main account (and so "did everything" from there instead of performing any tasks in the admin account)? [I realize that I'd have to go to the dedicated admin account to toggle the option off again.]

The reason I ask is that it sounds like there are some admin things that should really be done or can only be done in an admin account (instead of with spot admin authorization) and I'd like to be able to do these things from my main account (for convenience; so I could multitask; so I wouldn't have to worry about getting any settings in the admin account setup as I wouldn't really use it; to "get the best of both worlds"; etc).

I would use your main account as the administrator account so you do not have to switch back and forth. MacOS X will still ask you for your password when doing things that could compromise your system's security or stability.

 

[isleofjib]

i wouldn't set up your main user account as admin for security reasons. if your account was ever compromised while logged on as admin, the attacker could have higher level of control of your computer. on my computer, i have an admin account but work out of a non admin account. the good thing about OS X is when i want to install a program or make a change, i don't need to log out to do it. it will prompt me for the admin user ID and password. so have the best of both worlds.

 

[BigPrince]

I work in an admin account.

I believe ROOT access is the one you want avoid having your account doing.

I believe that under admin or a regular user account are prone to similar attacking strategies so by omitting a admin account I don't think prevents much.

 

[devilot]

A recent thread about how to change an admin into a standard account.

If you want some long reading... two threads that are relevant: here and here. (Note: iMeowbot's post in that last thread are what got me to start using a standard user account on a daily basis as opposed to one w/ full admin access.)

 

[gaussian]

Thanks for all your responses, especially to devilot for the last link -- what iMeowbot said on the subject makes it clear that my proposed workaround isn't actually effective (due to ownership of applications) and probably closer to the "worst of both worlds" than the opposite.

This still leaves me with the issue of whether to use an admin or standard account, but I should have most of the information I need so now it's just a personal decision.