Accounts, users, groups and privileges

Every account on a Mac is a door. The fewer doors that open onto administrator privileges, and the harder each door is to force, the smaller the damage a mistake, a stolen password, or a malicious app can do. This lesson covers account types, why the account you use every day should not be one, and what a defensible password policy looks like.

Administrator and standard accounts

macOS has two ordinary account types. Apple’s own guidance is direct about the trade-off: “an administrator should create a standard user account to use when administrator privileges are not needed. If the security of a standard user is compromised, the potential harm is far more limited than if the user has administrator privileges.”

The account created when you first set up a Mac is an administrator. It is worth creating a separate standard account for day-to-day work and reserving the administrator account for the moments that actually need it, such as installing software or changing a system setting. Apple also recommends against automatic login for an administrator account: “someone could simply restart your Mac and gain access with administrator privileges.” If FileVault is on, macOS disables automatic login for you.

sudo: temporary, not permanent, privilege

In Terminal, sudo lets an administrator run a single command with root privileges rather than granting them permanently. Only accounts already marked as administrators in Users & Groups can use sudo at all; a standard account cannot escalate itself. This is the same separation as the graphical login, applied to the command line: you stay logged in as a standard user, and reach for elevated privileges one command at a time, ideally rarely.

That distinction matters most at the moment a script, an installer, or a piece of software you did not fully vet asks for your password. Being asked at all is sudo and the administrator prompt doing their job; the judgement call is still yours, and it is the same judgement call whether it arrives as a graphical “this app wants to make changes” dialog or a Terminal password prompt. A password typed into a prompt you did not expect, for an action you cannot explain, is worth stopping and questioning rather than clearing out of habit.

What a sound password policy requires

It is tempting to assume a stronger password policy means more rules: uppercase letters, symbols, a digit, changed every 90 days. Current guidance from NIST’s digital identity guidelines (SP 800-63B) says the opposite on several points. Length matters more than composition rules, forced periodic changes should not be required “arbitrarily,” and passwords should instead be checked against lists of passwords already known to be common or breached, with a forced change only when there is actual evidence of compromise.

• Prefer a long, unique password (or passphrase) for your account over a short, complex one you will reuse or write down nearby.
• Do not set an expiration schedule for its own sake; change it if you have reason to think it leaked, not on a calendar.
• Use a password manager so “long and unique” does not depend on memory. macOS has one built in, called Passwords.
• Set a firmware or login password requirement after sleep or screen-saver activation, so a Mac left unattended for a moment is not simply usable by whoever picks it up.

Groups and file permissions, briefly

Under the hood, macOS is Unix: every account belongs to one or more groups (staff, admin, and others created by apps and services), and every file has an owner and a group with their own read/write/execute permissions. You rarely need to edit these by hand on a single-user Mac, but it explains why, for example, only accounts in the admin group can authorize privileged actions, and why a “Sharing Only” account (one that can reach shared files or screens remotely but never log in locally) is a real, distinct option worth knowing about if you occasionally need to give someone limited access without giving them a login.