Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Setting aside pushing a physical power button, can I prevent non-administrator users from initiating a software shutdown?

In Mac OS X Lion all users are allowed to shut down the workstation. How do I allow only the administrator to shut down the workstation?

share|improve this question
    
I believe if other accounts are currently logged in (like the administrator account), an administrator password is required to shutdown the machine. Maybe that is a solution? –  Gerry Jul 31 '12 at 13:47
    
Gerry not really. I am looking for a simple policy to allow only Administrators this right. –  Dragos Jul 31 '12 at 13:53
add comment

2 Answers

up vote 4 down vote accepted

You can use Workgroup Manager and OS X's managed preferences (MCX) to restrict access to the Restart and Shut Down commands in the Finder:

WGM 10.6

..then use the Accounts prefpane to show or hide the Restart, Sleep, and Shut Down buttons at the loginwindow:

enter image description here

share|improve this answer
    
da4 this is only obfuscation ? Without setting an ACL on /sbin/shutdown and /sbin/reboot there a normal user could still issue shutdown from terminal ? –  Dragos Aug 1 '12 at 7:34
    
I wouldn't call it obfuscation; you could also prevent opening the Terminal using MCX and disabling SSH access for non-admin users. Basically I'd rather use the given tools rather than trying to apply policies to system components that may or may not remain intact/working after further OS and security updates. –  da4 Aug 1 '12 at 15:28
    
Yes, you are right. Either ways Mac is not very good for multi-user environments. –  Dragos Aug 2 '12 at 7:52
add comment

This seems drastic, and I wouldn't want to test it on my system, but if one were really determined to prevent non-administrative users from properly shutting down the system, one could rename /sbin/shutdown. The program /sbin/shutdown, run on its own, requires administrative privileges, but ordinary users can invoke it through the shutdown command in the GUI. The shutdown command in the GUI does depend on /sbin/shutdown, though, so if the program is not found where it is expected, the GUI shutdown sequence will not complete.

If an administrative user wants to shut down the system, they can invoke the renamed /sbin/shutdown from the command line using sudo.

Note that none of this (or any other software solution) will prevent a user with physical access to the machine from pressing and holding the power button, simply pulling the power cord out of its outlet, tripping the circuit breaker for the circuit giving power to the computer, etc.

share|improve this answer
    
Thanks Daniel. I think I will add ACL to /bin/shutdown :D –  Dragos Jul 31 '12 at 13:22
2  
Also you might wish to restrict /sbin/reboot if desired. –  bmike Jul 31 '12 at 15:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.