Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can you disable Gatekeeper via Terminal Commands in OS X 10.8 Mountain Lion? I am looking to replicate the Security & Privacy preference pane selection to allow applications downloaded from Anywhere to run:

enter image description here

By having a terminal command, I can write a script to do this task remotely rather than manually going to each Mac and changing these settings with a mouse and several clicks.

share|improve this question
up vote 15 down vote accepted

The spctl tool should do the job.

sudo spctl --master-disable will turn off the Gatekeeper checks, and sudo spctl --master-enable will re-enable them (to the default setting of App Store and signed apps — it doesn't appear that setting it to App Store-only is possible).

Note that it will not throw any error if you run it without sudo permissions, but sudo is in fact required.

share|improve this answer
The man page says that spctl --disable --label "Mac App Store" Will disable installation of all Mac App Store Apps, so it would seem possible that it could --enable only M.A.S. apps. – Megan Walker Dec 20 '12 at 1:23
@SamuelWalker I didn't notice that before, but what would really be required is a rule or label that's equivalent to all non-App Store apps. Otherwise it's moot, as you can't disable all other sources independently from what I can tell. – robmathers Dec 20 '12 at 1:29
That's true. I've just looked in the actual SystemPolicy Database, and from what I can tell there's only a few labels that it uses. "GKE","Developer ID", "Mac App Store", "Apple System", "Apple Installer", "No Matching Rule". Although as these Strings are arbitrary [And may change in future OSX versions] this may be too hacky, but it seems possible that you could manually disable GKE and Developer ID. – Megan Walker Dec 20 '12 at 1:45
@robmathers, thanks for your response! I learned another work-around: you can right click the installer and click open (which will open the app w/o checking w/ gatekeeper) – Brian McCarthy Dec 20 '12 at 13:25
Yeah, that's definitely the easier way if you just need to run some something on a one-off basis. – robmathers Dec 20 '12 at 17:43
sudo spctl --master-disable

See the man page for spctl

share|improve this answer

Either of these also disables the Gatekeeper dialogs (after restarting), but they don't change the setting shown in System Preferences.

sudo defaults write /var/db/SystemPolicy-prefs.plist enabled -string no
defaults write LSQuarantine -bool false

I don't know if spctl --master-disable is somehow different from disabling Gatekeeper from System Preferences, but spctl --status changes to assessments disabled after disabling Gatekeeper in System Preferences.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.