How can I prevent a user to use admin rights to work around restrictions?

Question

We just bought my husband a new Mac. Currently, we each have parental restrictions requiring a password on our accounts when it comes to "mature" ratings on our iPhones and iPads (older generations) This holds us accountable for each other and prevents inappropriate "adult" material from being viewed:downloaded on our machines and causing issues in our marriage. However, with the new MacBook Air that we purchased, he is the administrator because it is his computer. We noticed you can't set up parental controls as the administrator. Is this correct?

If he were to set up another account as a guest, could he still use his iCloud under that setting? Could we lock the administrator account so that settings could not be changed? Could someone set the password for "administrator" to something we don't know and have him use an account as a managed user under his Mac?

What is the best way to own the computer, be the primary user but also set self limitations?

Answer 1

Well, somebody (aka at least one user account) needs to have full admin privileges on a Mac, there is no way around it. If you want to restrict the ability of an account, you will have to set up a dedicated user account (and define Parental Restrictions for it) and use this account for day to day work.

You would still need an admin account to install software etc, so you could for instance split the admin password in half, with each of you only knowing one part. Whenever an admin password is required, you both would need to sit in front of the Mac then and enter your respective half.

Answer 2

Screen time can also be used to limit admin users and you can set a passcode to protect screen time settings, so that the settings cannot be altered unless you know the passcode, whether you are an admin user or not plays no role (no passcode, no change).

Answer 3

Filter/Monitor this at the Network level

It may seem counterintuitive to recommend a non-Apple product on an Apple centric website, but the main issue you have here is a permissions issue. Essentially, what one one administrator can do, another administrator can undo.

By taking this to the “network” level, you eliminate all the permissions issues, the configuration tasks for each machine. You also have the added benefit of covering all connected devices regardless of operating system,

For instance, suppose one of you grabs the super cheap $50 USD Amazon Fire Tablet that goes on sale every year around Christmas and decides to covertly use it to browse those risqué real estate listings. Apple parental controls will never catch this, but something running at the network level will because all traffic has to go through the network.

There are many products and services that can meet your needs here:

• Internet routers with parental controls and reporting capabilities
• DNS (Domain) filtering services (cloud based) that allow you to configure what gets blocked with reporting

The Correct Approach

I am the last person to offer relationship advice, but I do know there is no product on the market that can fix trust issues. If there is a fundamental lack of trust between two people, the correct fix is to address that directly with the help of a professional. The monitoring/reporting products and services can help validate that trust, but they won’t fix it. I genuinely hope you can find a solution to the issues you face.