3

I have a Macbook with several user accounts. Most of the accounts have administrator privileges. The computer's hard disk is encrypted using FileVault.

Is there a way to additionally encrypt each users' home directory so as to prevent other admin users from accessing the others' directories?

I'm (always) running the newest OS X (10.10.4 at the time of writing).

Improve this question
4
  • 1
    See apple.stackexchange.com/questions/99646/…. Basically the idea is to create an encrypted area for your documents etc. only (not for your whole home folder because this would make login rather difficult).
    – nohillside ♦
    Jul 11, 2015 at 14:19
  • The newest OS is off topic here. We prefer you to specify your version and build since posts should be useful two years later. Also, wile you're editing, please make this different than the linked question above. This sure looks like a duplicate question without some more details or explanation as to how your setup is materially different than the other asker.
    – bmike ♦
    Jul 11, 2015 at 14:34
  • @bmine, Now that OS X 10.11 is in public beta is it still not allow to be discussed? I thought once it went to public beta it was allowed.
    – user3439894
    Jul 11, 2015 at 14:40
  • There is discussion on changing betas - but not enough consensus to change the policy of the site. See meta.apple.stackexchange.com/questions/2537 and meta.apple.stackexchange.com/questions/1712
    – bmike ♦
    Jul 11, 2015 at 14:41

1 Answer 1

Reset to default
3

Encrypting the entire user folder will break OS X 10.10 since certain user processes get started before you log in.

You might have to re-evaluate your security levels for users if you can't trust administrators to not abuse their power. FileVault only protects you against non-users. Admin users are root and you can only hope they a) don't know that or b) refrain from bad behavior.

Look at a MDM solution like Casper from JAMF. It has a self-service tool that allows app updates and limited administrative tasks without needing end users to be admin. All users can easily be normal users whether you make tools to do the limited things they need or purchase a tool that has those policies already created.

Improve this answer
2
  • 1
    It's less a matter of distrusting the administrators, and more one of attempting to limit the impact of human error (e.g. malware getting run) to the data of just the directly affected account.
    – Kallja
    Jul 11, 2015 at 14:44
  • @Kallja Excellent point. If you're at the point where you realize you want or need to scan for malware and control for it, making users non-admin makes even more sense. I might deploy something like github.com/facebook/osquery in the interim while you decide on what MDM package suits your needs for protection and control and auditing and logging.
    – bmike ♦
    Jul 11, 2015 at 15:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .