How can you disable Gatekeeper via Terminal Commands in OS X 10.8 Mountain Lion? I am looking to replicate the Security & Privacy preference pane selection to allow applications downloaded from Anywhere to run:

enter image description here

By having a terminal command, I can write a script to do this task remotely rather than manually going to each Mac and changing these settings with a mouse and several clicks.

3 Answers 3


The spctl tool should do the job.

sudo spctl --master-disable will turn off the Gatekeeper checks, and sudo spctl --master-enable will re-enable them (to the default setting of App Store and signed apps — it doesn't appear that setting it to App Store-only is possible).

Note that it will not throw any error if you run it without sudo permissions, but sudo is in fact required.

  • 1
    The man page says that spctl --disable --label "Mac App Store" Will disable installation of all Mac App Store Apps, so it would seem possible that it could --enable only M.A.S. apps. Dec 20, 2012 at 1:23
  • @SamuelWalker I didn't notice that before, but what would really be required is a rule or label that's equivalent to all non-App Store apps. Otherwise it's moot, as you can't disable all other sources independently from what I can tell.
    – robmathers
    Dec 20, 2012 at 1:29
  • That's true. I've just looked in the actual SystemPolicy Database, and from what I can tell there's only a few labels that it uses. "GKE","Developer ID", "Mac App Store", "Apple System", "Apple Installer", "No Matching Rule". Although as these Strings are arbitrary [And may change in future OSX versions] this may be too hacky, but it seems possible that you could manually disable GKE and Developer ID. Dec 20, 2012 at 1:45
  • @robmathers, thanks for your response! I learned another work-around: you can right click the installer and click open (which will open the app w/o checking w/ gatekeeper) Dec 20, 2012 at 13:25
  • Yeah, that's definitely the easier way if you just need to run some something on a one-off basis.
    – robmathers
    Dec 20, 2012 at 17:43
sudo spctl --master-disable

See the man page for spctl


Either of these also disables the Gatekeeper dialogs (after restarting), but they don't change the setting shown in System Preferences.

sudo defaults write /var/db/SystemPolicy-prefs.plist enabled -string no
defaults write com.apple.LaunchServices LSQuarantine -bool false

I don't know if spctl --master-disable is somehow different from disabling Gatekeeper from System Preferences, but spctl --status changes to assessments disabled after disabling Gatekeeper in System Preferences.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .