I am utilizing the most recent macOS model (Sonoma as of December 2024), and I’ve arrange a Commonplace account for myself, whereas a trusted good friend holds the admin account credentials.
I would like my Commonplace account to have the power to:
-
Set up macOS updates (e.g., safety patches, new macOS variations).
-
Replace apps downloaded from the Mac App Retailer and exterior sources
(e.g., direct downloads, Homebrew, VSCode, Github Desktop).
Nonetheless, I additionally need to limit the next capabilities:
- Manufacturing unit resetting or erasing the Mac.
- Accessing particular apps (e.g., Apple Configurator) and modifying
sure system settings. - Eradicating or modifying a particular configuration profile I’ve arrange
for system administration.
I’ve thought of the next choices, however I’m unsure the place to start out:
- Utilizing sudo to grant particular permissions to the Commonplace account for
sure duties, like updating apps and putting in macOS updates. - Locking delicate settings and apps utilizing Display Time or System
Preferences (Screentime ‘s 1 minute minimal restrict is simply too lengthy to be efficient). - Enabling computerized updates for macOS and (each system, App Retailer, and exterior) apps to keep away from handbook
updates. - Preserving the Commonplace account as an admin, however proscribing entry to particular apps or stopping the removing of profiles. After consulting a earlier query, the consensus was to take away admin privileges altogether, which appears to be the really helpful strategy.
However I’m unclear on find out how to arrange these instruments successfully with out by chance granting extreme privileges or shedding management over the particular restrictions I need to keep.
My questions are:
- How can I configure the Commonplace account to have admin-like
privileges, particularly for updates and app administration, with out
giving full admin entry? - What are the perfect methods to lock down particular apps (like Apple
Configurator) and forestall entry to or removing of a particular
configuration profile? - Are there any instruments or strategies (like MDM, customized safety
profiles) that might assist me obtain this setup whereas retaining the
system safe and restricted, and are hopefully free to make use of?
