This is a followup on this post of mine: Application permissions for Standard user

I'm now running MacOS High Sierra 10.13.5 and this problem is still irritating.

I use my Mac as a Standard user. When I first set it up, all applications were downloaded/installed using the Admin user.

When using my Mac as the Standard user, every time I go to run an application I get the following message:

"Whatever.app" is an application downloaded from the Internet.
Are you sure you want to open it?

With the options for Cancel and Open. Of course I choose Open and everything works fine.

Now, I am used to this notice appearing the first time I try to run an app from the internet. My problem is that it appears every time.

Note that I am not asked for any Administrator credentials, and these apps have already been installed to the /Applications directory as an Administrator.

I have tried with a different Standard user and still have the same issue. I have also already used Disk Utility to repair the drive permissions, just in case.

How can I make this notice appear only on the first run?


More details:

If I install an application, while logged in as the Standard user, but authenticating as the Administrator, then it only warns me about the Application on the first run, and then never again, as long as I am still logged in as that Standard user.

But all the applications I installed while logged in as Administrator give me a pop up warning every time if I try to run them while logged in as a Standard user.

There is a "solution" to this problem, but it is so incredibly inelegant. For every application I downloaded and installed, while logged in as Administrator, simply installing the application is not enough. I must actually login as the Administrator and launch the application at least once to clear the warning for all other users. This seems incredible silly. Surely there must be a better way to accomplish this?

2 Answers 2


The basic problem is that the applications are all marked as being in quarantine (they have the "com.apple.quarantine" extended attribute) because they were downloaded from the net. Running the app removes the quarantine attribute if the file permissions allow you to modify the file (e.g. if you're the file's owner -- in this case, the Admin user). If you don't have permission, the quarantine attribute stays, and you keep getting the "downloaded from the Internet" message over and over.

Solution: one way or another, you need to remove that quarantine attribute. You can do this for a bunch of apps at once in Terminal.

  1. First use su (switch user) to switch to your admin user (type in "su", then a space, then the account name of your admin user, then press return and enter the admin account's password; note that the password won't be displayed as you type). It should look something like this:

    Dans-Mac:~ dan$ su adminacct
  2. If that works, type in "xattr -r -d com.apple.quarantine", then a space, then drag all the apps you want to dequarantine from the Finder to the Terminal window; when they're all listed, press return. Note that you can drag them one at a time or in groups, whatever's convenient. Something like this:

    bash-3.2$ xattr -r -d com.apple.quarantine /Applications/BBEdit.app /Applications/Firefox.app
  • 1
    This works on a per app basis. Thanks a lot. I just wish that xattr -r -d com.apple.quarantine /Applications/*.app would work. It doesn't.
    – Daniel
    Commented Jul 9, 2018 at 5:22
  • 1
    @Daniel That will give you a massive pile of errors, but in between the errors it should work for all the apps you have permissions to remove quarantine from. You can check for remaining quarantined apps with ls -l@ /Applications, and look for "com.apple.quarantine listed after any of the apps. If there are any, you may have to run xattr as their owner, or maybe as root by prefixing the command with sudo (note that you must already be running as an admin in order to use sudo). Commented Jul 9, 2018 at 5:39
  • Why not run sudo xattr ... from the beginning? Completely switching to root is just a bit creepy if you once in a while run rm -r ... and happen to start at / by accident.
    – qwerty_so
    Commented Mar 25, 2020 at 21:00
  • Also rather than dragging apps you could just append their path like /Application/<...> where you can either use wild cards, regex or tab-complete to what is needed.
    – qwerty_so
    Commented Mar 25, 2020 at 21:04
  • @qwerty_so sudo won't work from a non-admin account; that's why I recommended using su to switch to the admin account that installed the apps (not to root). As for tab-completion, wildcards, etc: yep, those'll work great here, but I was aiming the instructions for someone who isn't used to shell syntax. Commented Mar 25, 2020 at 21:13

Gordon Davisson's answer worked for me, but for whatever reason, my Applications folder was showing as empty in Finder and with ls . So to get the path/name for the application I wanted to clear, I had to use

sudo find / -iname *.app

to get paths for all installed apps (as found on https://www.howtogeek.com/409377/how-to-list-all-applications-on-a-mac/).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .