Publishers of technology books, eBooks, and videos for creative people

Home > Articles > Apple > Operating Systems

Macintosh Reference Guide

Hosted by

Toggle Open Guide Table of ContentsGuide Contents

Close Table of ContentsGuide Contents

Close Table of Contents

Require Password to Wake

Last updated Feb 25, 2005.

Reader Jeff Nurmi writes: "Hi, I have a question about the Security preferences in OS X that I was hoping you would be able to help me out with. In Security preferences, there is a checkbox for 'Require password to wake this computer from sleep or screen saver.' I understand what this option does; my problem is that I want to lock this checkbox so that only administrators can change it. If a standard user logs on to the Mac, they can open Security preferences and deselect this checkbox. Is it possible to lock the Security preferences?"

I must admit, at first I thought this was going to be a slam-dunk easy answer since I had recently covered the topic of Security preferences. I opened Security preferences and selected the "Require password to unlock each secure system preference" checkbox. Then I clicked the lock in the lower left corner to prevent further changes. I was surprised to see that the "Require password to wake this computer from sleep or screen saver" checkbox could still be deselected, even though all of the other checkboxes were dimmed (see the following figure).

Figure 139

Figure 139 Apparently requiring a password to wake the Mac is not a "secure" system preference, despite being in Security preferences.

Hmm. That's odd. I assumed that all of the options in Security preferences would be considered secure, and therefore require a password to unlock. I figured perhaps Mac OS X was not asking me to enter a password for this option because I was logged in as an administrator, so I chose from the User menu at the far right of the menu bar and logged in as a standard user. Nope, that made no difference either. Regardless of whether I was logged in as an administrator or a standard user, the one checkbox Jeff wants to lock remained accessible without a password.

It occurred to me that perhaps I needed to further restrict non-administrator users by implementing some parental controls, another topic I've recently covered in this guide. Hopping over to Accounts preferences, I selected a standard user, clicked Parental Controls, selected Finder & System, clicked Configure, then clicked OK after confirming that the "Open all System Preferences" checkbox was not selected. Again taking advantage of fast user switching, I soon discovered that wasn't the fix; managed users can still access Security preferences and toggle the checkbox Jeff wants to lock (see the following figure).

Figure 140

Figure 140 Even users with managed accounts restricted by parental controls are able to open and change all of the System preferences that are not dimmed.

Only after having struck out with my first two approaches and then rereading the last sentence of Jeff's query—"Is it possible to lock the Security preferences?"—did a brute force solution become obvious. Instead of looking for a feature that did specifically what Jeff wanted, why not use a general feature of Mac OS X to achieve the desired result? The trick was to manipulate the ownership & permissions of the actual preferences pane file.

Begin by setting the Security preferences exactly as you want them, because in a moment standard users won't have access to this nice front end to make changes. Now, in the Finder, open the /System/Library/PreferencePanes folder. (This is where Mac OS X stores the standard panes that appear in System Preferences. These are not the files that store the individual users' actual preference settings for each pane.) Select the Security.prefPane file; choose File > Get Info (Command-I); open the Ownership & Permissions disclosure triangle; then open the Details disclosure triangle. Authenticate as an administrator; then make yourself the owner with Read & Write access; assign the group to admin, also with Read & Write access; and give others No Access (see the following figure).

Figure 141

Fugyre 141 Changing the Ownership & Permissions settings on the actual preferences pane file achieves the desired results.

With its new settings, Security preferences is still available to administrators as before, but whenever a standard user clicks the Security icon in System Preferences, an error dialog appears since they do not have any access to the necessary pane, preventing them from making any changes. Granted, it's more of a hack than an elegant solution (your new settings will disappear the next time you repair permissions with Disk Utility), but given the tools readily at our disposal, it'll do just fine. Clearly, it would have been easiest had Security preferences worked as presumed, but for some reason, Apple left unlocked the one option Jeff wanted to protect.

This week's exercise demonstrates a few important concepts. First, don't invest more time fixing a problem than it's worth. Second, if at first you don't succeed, try attacking the problem from a different angle.