What is the process (if any) for disabling other users ability to create local accounts on a macOS device (including local administrators)? An alternative would be also to disable local administrators ability to create local accounts entirely which is also fine, as we use Active Directory for authentication. I know in Windows I can use local and AD group policies to manage this on Windows systems but I'm not familiar with a local group policy application in macOS.

We centrally manage full disk encryption on our mobile estate and users creating their own logons on organisational devices is something we'd like to avoid.

Many thanks in advance.

  • 2
    Not making the user(s) Admins is probably the most effective way to do this.
    – Allan
    Jul 11 '18 at 13:50
  • 1
    I absolutely agree, but I'm unfortunately not in a position to recommend a change in policy, yet. We've had a new director since we were asked to stop requesting a business justification for admin rights so we might be able to change things in due course but not immediately. Being an academic institution the subject of admin rights is a tricky one sadly.
    – lwardso
    Jul 11 '18 at 16:22
  • 1
    I know exactly what you mean...I deal with exactly that for a living.
    – Allan
    Jul 11 '18 at 16:34

You will need to use Apple MDM software to accomplish this.

Under macOS Supervised Restrictions, you can prevent users from creating accounts:

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .