You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

User password versus Admin password

Hi there,


I'm working in a small company, where I have 5 employees in a graphic design studio and print house.

We are using Mac computers and have done so since I established the company.


We have to improve our workplace with 3 other employees. Therefore we also have to make a new architecture of our user-policies. I must admit, that I'm a bit new to user policies, but hope some kind person can help me to answer my questions.



1): I know from time - back in school and Windows computers - Every user got their password for the login. It was possible to install apps if we needed, but we couldn't change any settings. It was only the administrators, who could do this with their user-info and passwords. Is it possible to do the same in the Mac environment?


Cause now everytime someone need to install an app. It requires the admin password or if a user need to change something in other apps or settings.


2): What can I use in the future for fx. user-settings, since Apple have made an end of the Server-software.

Cause what if an enterprise company have 100+ macs over a network. How to admin all these?


3:) If I have an older Mac Pro I want to use as file-server. Will it be possible to make connection to the shared folders outside the local-network, but thorugh the Internet?


I have the the router which can do it, but I need to know how to set up the Mac Pro to accept the access from the MacBooks outside the LAN, but through the internet. (I'm NOT looking for any desktop/monitor-support-solution).


I hope you will give me your best replies. Thank you.


Best regards,


Mac Pro (2019)

Posted on Apr 8, 2024 9:38 AM

Reply

Similar questions

1 reply

Apr 9, 2024 8:21 AM in response to candi_dk

1: Yes. Macs support two basic account types: Administrator and Standard. Every Mac will create an Admin account when first powered on. However, you can create additional accounts (Apple menu > System Settings... > Users and Groups) as Standard accounts. If you want your end users to be standard users, then when you initially setup the Mac, create a unified admin account that you know the credentials for. Then create a second Standard account for your user. Please note, the ARM based Macs require an admin to be logged in to apply OS updates. If you embrace the Standard user account, your end users will not be able to apply updates. You will need to physically go to each device, login as the local admin, and then run the updates. Also, Standard users cannot pause or resume print queues. Since you are a design studio, you may have a fancy printer or print server. If the printer ever has an issue, and the print queue on the Mac is paused, you will need to drop in to authorize the resume (this can be overcome by adding everyone to the lpadmin group using dseditgroup).


Now, an expanded answer is that macOS also supports cloud accounts. This can included Apple IDs, Managed Apple IDs, Microsoft IDs, Google IDs, and most other identity providers (ping, octa, etc.). However, for this to work, you will need an MDM that supports a login window shim. One example is Jamf Connect via Jamf Pro. In this example, the login window will be the Microsoft cloud login window, allowing the user to use their O365 ID to log into the Mac. Jamf Connect now includes a temp admin feature to allow Standard users to temporarily promote themselves to admin. This is a more advances setup but one that can provide exactly what you are looking for. Apple is working on Platform SSO, but that will require an MDM to enable.


2: Apple platform management is performed via an MDM. There are many MDMs on the market. Some to investigate are Jamf Pro, Mosyle, Intune (Microsoft), and Apple Business Essentials (this is really only good for incredibly simple deployments - you likely use Adobe products... don't try to user Business Essentials). But before we talk MDM, you should take a look at Apple Business Manager (Apple Business Manager and Apple Business Essentials are two different things). Apple Business Manager is a free service provided by Apple that is the foundation stone for fleet management. It provide chain of custody for hard assets (Macs, iPads, etc.), soft assets (apps and books available in Apple's online stores), and identity federation for the creation of Managed Apple IDs. Apple Business Essentials is Apple's MDM that replaced Profile Manager (included with Server.app). ABM is free. ABE costs money just like other MDMs. Sign up for ABM here.


Remember, deploying an MDM makes managing the Apple Platform easy. Deploying an MDM is hard. Consider reaching out to a consultant or managed service provider to rapidly and properly deploy your MDM.


3: I discourage the use of traditional file servers. Look at FileProvider services like Microsoft or Dropbox. However, if you are adamant in the use of the old Mac Pro as a file server, DO NOT, DO NOT open up the SMB port to the Internet (port forwarding). That will be a huge mistake. Setup a VPN and then your remote users will perform a two step process of connecting to the server. Step 1: connect to the VPN. Step 2: Connect to the file server over the VPN connection. This is the safest way to provide access to LAN based resources. If you simply do an SMB port forward, then malicious port scanners will find your server and hammer it with login attempts. For the VPN to be most effective, you should have a static public IP address. Check your Firewall to see what type of VPNs it supports. macOS supports L2TP, Cisco, and IKEv2 natively. Many firewall vendors have their own apps for SSL based VPNs. And there is always VPN Tracker that supports most everything. Please note, SMB performance over a VPN is notoriously crappy. Again, I encourage moving on from traditional file services and embracing cloud document storage. Yes, there are monthly fees. Yes, graphics departments have larger data sets. But there is flexibility and security.


Hope this is helpful.



User password versus Admin password

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.