Admin account versus non-admin account for daily work on OS X

Problem statement: A long time ago I decided that doing most of my daily
work in a non-admin account was the only sensible thing to do. For me
it's a matter of discipline and good practice.

I have now come across someone who is technically very competent but is
telling OS X newbies that using an admin account for daily work is much
safer than in Windows and actually encouraging it.

For me it's a no brainer to say no, he's wrong, but I could do with some
technical arguments and hopefully examples to explain my point of view.

Cheers in advance for your input.

 

There is no need to explain your point of view.

Any time you need administrator rights while using a non-admin
account... ...you've got 'em.

--
Alan Baker
Vancouver, British Columbia
"If you raise the ceiling four feet, move the fireplace from that wall
to that wall, you'll still only get the full stereophonic effect if you
sit in the bottom of that cupboard."

 

At the GUI level, I am somewhat puzzled on why some activities can be
performed without spaecial stuff on an admit account, some require entry
of the administrator password, and others can't be done, you need to go
command line and sudo the command to get it done.

 

Running in an admin account allows more opportunity to screwup,
including ways that can result in a non-functional install and loss of
important data. It also opens the doors for either badly written or
outright malicious scripts and apps to wreck havoc.

Why make it easier for things to go wrong? I mean - how often are people
accessing protected folders and preferences in a standard user account?
I install at least one app a day (nightly builds I test), but that's
unusual. I also maybe change a system preference requiring
authentication once a week. Oh, and I run Software Update daily.

So I have to enter my login info three times max, and usually only twice
most days. It's not even worth debate. For a few seconds a day I get
greater peace of mind from my own mistakes, other people's mistakes, and
malicious attempts to take control of my Mac.

Running as a standard user isn't some invunerability shield, but it's
the difference between locking your front door and leaving it wide open.
You don't make it easier for things to go wrong if the downsides are
negligible - it's that simple

 

You his mother, they often say what their sons do and do not need?

The best argument I know is that if anyone does break into your
account while online or physically while you are logged in as admin,
they have access to far more than they would if you were not so logged
in and can cause more trouble and that it is therefore basically
sensible from a security point of view to normally run as non-admin.
Why tempt fate?

 

Not "all", but most of them.

YK

 

Adding an item to Software Update's ignore list.

 

Right, so no built-in way to do that task using the GUI exclusively,
from a non-admin account.

 

Run Apple Remote Desktop.

YK

 

I have seven accounts on my iMac, one administrator and six user
account. One of the user accounts is for my day to day internet
exploring and such. The remaining five user accounts are for projects I
am working on and where I like to keep all of the parts of the project
isolated. Maybe this won't work for others but it works just fine for
me.

 

http://www.sans.org/score/macosxchecklist.php

See "Types of User Accounts and Account Philosophy" starting on page 6.

Who is SANS?

http://www.sans.org/about/sans.php

Billy Y..

 

I also have seven; two standard for my wife and me, two managed for the
kids. One non-admin test account for troubleshooting. One non-admin
account used only for EyeTV and watching movies, and one admin
account. The account that is used the least is the admin account. I
can't remember the last time anybody has logged in to it. No need to.