different levels of Administrator?

[DanL]

My wife got a Mac at work, and she was assigned as "Administrator". The Mac was set up with all manner of security stuff, which is useful at the office, but not appropriate when working at home. She says that she can't diddle with that stuff, and it takes a higher level of Administrator to do that. There are different levels of Administrator? That doesn't sound right to me. Can a Mac be set up in ways that a regular Administrator can't touch? Certainly a security app can have a password, but can't an Administrator just turn off that app entirely? Are there MacOS things that a regular Administrator can't do?

 

[Cory Cooper]

Hi,

There isn't a higher level user account than an admin. Many companies and schools use a Mobile Device Management (MDM) system to install/configure their own set of software and security measures. Since it is a company-owned device, and/or used on a company network, the security polices they put in place can't be paused/disabled by the employee.

Hope that helps!

C

 

[DanL]

Well, OK. I'd call that a higher level of Administrator even if not a User account. How does one recognize an MDM on a Mac? Is there anything conspicuous? How is the MDM accessed? Is it by launching a regular application?

 

[DanL]

OK, I think I figured it out. On this computer, in Users & Groups, my wife is listed as "Admin, Managed, Mobile", and the people who run the show are listed just as "Admin". So, yes, we're evidently looking at MDM here. There are two Administrators, but one is "managed". Thank you!

 

[DanL]

Whoa. So "Admin, Managed, Mobile" doesn't mean MDM? Whew. But thank you for explaining all of those.

And yes, System Preferences-> Profiles only appears if someone HAS installed a profile, and on this machine they did, with Bomgar Security, and a whole bunch of restrictions, including MDM. So the rule is, if you suspect MDM, go look for a Profile. I have to assume that you can't delete this profile except with some special password known only to the people who installed it.