Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

Hide system-wide preference panes from non-admin users Apps
In setting up a multi-user computer for our music lab, I found that even when you uncheck the User can change: "password" option, the user can still access it if they have access to the System Preferences. Though they can't change it through "my accounts", they CAN change it through "accounts". As they need access to some of the other control panels, I couldn't use the option to disallow access to most preferences.

However, by locating the Accounts.prefpane in the /System -> Library -> PreferencePanes folder, and changing the owner to the admin user, and making so that others have no access, you can effectively hide it for anyone but the Admin user. Use the Terminal or Get Info to change the file's owner, and then restrict access for anyone other than the owner.
    •    
  • Currently 2.75 / 5
  • 1
  • 2
  • 3
  • 4
  • 5
  (4 votes cast)
 
[7,718 views]  

Hide system-wide preference panes from non-admin users | 7 comments | Create New Account
Click here to return to the 'Hide system-wide preference panes from non-admin users' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Hide system-wide preference panes from non-admin users
Authored by: matx666 on Oct 09, '03 11:53:47AM

I just change the owner (chown -R) to system: wheel and be done with it. they can't launch it all. if i need to change something locally i will override with admin pass.



[ Reply to This | # ]
Hide system-wide preference panes from non-admin users
Authored by: ArtemisG3 on Oct 09, '03 01:50:48PM
Here's a problem:

Once you run Repair Permissions, the preference pane is accessible again.

So, is there a better solution?

[ Reply to This | # ]

Hide system-wide preference panes from non-admin users
Authored by: pme on Oct 09, '03 02:31:38PM
"Once you run Repair Permissions, the preference pane is accessible again.
So, is there a better solution?"


Move the prefpanes you want to hide to:
/Users/admin-user-name/Library/PreferencePanes/

If you need access for more than one user, use aliases... Just remember to temporarily move them back when you do system upgrades...

[ Reply to This | # ]
Hide system-wide preference panes from non-admin users
Authored by: extra88 on Oct 09, '03 01:59:20PM

I would remove access for "Others" to the Pane's folder then change the folder's group from "wheel" to "admin." This allows admins to still see and use the Pane but non-admins don't even have the pane show up.

To change permissions:
sudo chmod 750 /System/Library/PreferencePanes/Accounts.prefPane
To change group membership:
sudo chgrp admin /System/Library/PreferencePanes/Accounts.prefPane

Note that I'm not using the Recursive options, you don't need to change the permissions or group membership for anything inside the directory.

As someone else mentioned, Repair Permissions would overwrite these changes. The only way to avoid that is to move the PrefPane to the home directory of one account. Of course then that one account is the only one which can use the PrefPane. There's also a good chance a PrefPane could get reinstalled by an OS update. I would stick with modifying permissions and but save the above commands in a script to make reapplying the change easy.



[ Reply to This | # ]
Hide system-wide preference panes from non-admin users
Authored by: governator on Oct 09, '03 03:03:18PM

you guys are failing to see the simple solution:

just go to capabilities in the Users Control Panel and set the user to use "Simple Finder" and only the apps you want them to be able to access. no problem



[ Reply to This | # ]
Use Capabilities
Authored by: DangeRuss on Oct 09, '03 05:57:47PM

Why not adjust the users' Capabilities in the Accounts System Preferences. For a non-admin user, just select the user, click Capabilities and then uncheck "Open All System Preferences." The user can now only access the Personal category of System Preferences.



[ Reply to This | # ]
Use Capabilities
Authored by: mcroft on Oct 09, '03 11:41:49PM
Another Option:
use the Preference Pane (and other system gizmo) manager Diablotin.
This would let you let restrict items on an individual basis (no "accounts" or "sharing" pref panes, for ex), while leaving others available. You or any admin can change it with an admin password.


[ Reply to This | # ]