I use my Mac as a Standard user. When I first set it up, all applications were downloaded/installed using the Admin user. Running latest OSX 10.10.3

When using my Mac as the Standard user, every time I go to run an application I get the following message:

"Whatever.app" is an application downloaded from the Internet.
Are you sure you want to open it?

With the options for Cancel and Open. Of course I choose Open and everything works fine.

Now, I am used to this notice appearing the first time I try to run an app from the internet. My problem is that it appears every time.

Note that I am not asked for any Administrator credentials, and these apps have already been installed to the /Applications directory as an Administrator.

I have tried with a different Standard user and still have the same issue. I have also already used Disk Utility to repair the drive permissions, just in case.

How can I make this notice appear only on the first run?


I found another "clue". If I install an application, while logged in as the Standard user, but authenticating as the Administrator, then it only warns me about the Application on the first run, and then never again, as long as I am still logged in as that Standard user.

But all the applications I installed while logged in as Administrator give me a pop up warning every time if I try to run them while logged in as a Standard user. There must be a way to fix this.



"Solution": For every application I downloaded and installed, while logged in as Administrator, simply installing the application is not enough. I must actually login as the Administrator and launch the application at least once to clear the warning for all other users. This seems incredible silly. I'm glad I found a "fix", but surely there must be a better way to accomplish this?

  • Is this before or after reset ACLs? – Tetsujin Jun 26 '15 at 15:46
  • OS X uses the com.apple.quarantine attribute on the application bundle, as well as the database entries stored in "~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2" to determine whether or not to show that message. You can try running sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 .dump|grep -i LibreOffice replacing LibreOffice with whichever application is exhibiting this issue, and see if you get any results. If not, then it's possible there's an issue with this database. – William T Froggard Jun 26 '15 at 17:24
  • If you do get a result, post them here along with the result of xattr -p com.apple.quarantine /Applications/LibreOffice.app, or compare them yourself, again, replacing LibreOffice with the name of an application exhibiting this. The first value in the database record should match the last value in the extended attribute. – William T Froggard Jun 26 '15 at 17:27
  • I used VLC as an example. sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 .dump|grep -i VLC No result. – Daniel Jun 27 '15 at 19:23
  • I also reset the user permissions and ACLs before this. – Daniel Jun 27 '15 at 19:24

You must log in to answer this question.

Browse other questions tagged .