Mac Admin Privileges: Controlling Security and Updates with Jamf Pro

When you set up a new Mac, you’re made the administrator of that machine by default.

That’s great and super-useful if you’re a home user, but if the Mac happens to be a business device, it can cause security and compliance issues – particularly for organisations that don’t have dedicated Mac admin teams (few do – it’s why we exist, after all!).

Big organisations running multiple Macs need their users to be standard users. But non-admin roles can cause issues for workers – particularly in cases where it’s within the business’s interests to give them the ability to install software and tweak their devices.

The good news? We know of a rather smart way to get around this – safely.

The importance of making informed decisions

Let’s assume you’re running a business that has a team of developers using Macs. Every day, they’ll tell you that they desperately need administrator rights to do their jobs properly.

So, you give them those rights and, lo and behold, three months later your Macs are infested with malware and increasingly suffer from poor performance.

This is why, whenever we’re tasked with enabling Mac users to undertake their jobs unhindered without administrator privileges, we start by gathering information from both their machines and their use cases.

What, exactly, do they need to do on that Mac? Is there more than one way to achieve the desired result, and, if so, which one offers the right balance of security and user satisfaction? We can only make informed decisions about admin privileges if we do our homework which is why we always start by asking questions.

Rather than asking the users about their admin usage patterns, we gather the information directly from the devices, noting when admin rights were used, on which device and what it was used for.

Collating this information enables us to make additions to the central device management system to remove the need for local admin privileges and to identify more extreme power users that may need a higher level of device access than standard users.

Hey, you may not need admin rights!

As noted earlier, larger companies will often have Mac users who make non-admin user levels rather challenging. This is usually the case with developers, or anyone who needs to install software or plugins that are required for their job.

As you’d guess, they’ll argue that they need admin privileges. No question; it’ll be painted as an absolute necessity.

This almost certainly isn’t the case. But it’s also why we spend a good deal of time gaining buy-in from team members who are convinced that anything other than administrator privileges will be a massive pain for them.

This is where Jamf Pro comes in. We configure it to provide a self-service button for users of this kind which grants them 30 minutes access to undertake their admin-like tasks. Every time they access the self-service feature, their activity is logged, enabling the admin team to see what they did and when they did it. Once the 30 minutes is up, they return to standard user status.

So, why not give them full admin rights instead? The reason is simple. The tasks they need to perform with admin privileges are likely to be few and far between, which makes the Jamf Pro self-service option so sensible. They can get in, do what they need to do, and get out. In an alternative universe where they have full admin privileges permanently, they can – and probably will – inadvertently (or purposefully) do far more damage by installing malicious software, even if that’s never the intention.

Minimising risk (and answering the remaining critics)

For most team members, the Jamf Pro solution will be the perfect balance and address their concerns. But a few may argue that it’s still not enough.

Admin privileges on Macs offer a wealth of access above and beyond anything a normal user can do. The users who are claiming they need that level of access simply won’t need 95% of the functionality on offer; usually, they’ll just need the ability to install tools and updates to do their jobs.

By instead using Jamf Pro, your business will be minimising risk by removing anyone who doesn’t need full administrator access and granting temporary access only to the people who do.

The best news? Jamf Pro can issue these capabilities via a database that checks and installs the updates automatically, so there’s no downtime or heavy lifting required if you want to implement this vital form of Mac security.

If you want to find out more about Jamf Pro or Mac admin privileges, just get in touch with the helpful team at moof IT today.