Administrator access to /users folder

This isn't Mac OS 9 anymore:

1. If you're already an administrator you can access user files any time you need. Administrators don't need to change user folder permissions to grant themselves access because they can elevate themselves to root.
2. Being an administrator doesn't mean you should give yourself carte blanche to everything under your purview. Yes, as an administrator you can do this, but that doesn't mean you should.

If you need to gain access to a user's files because he has left the company or because your HR has reason to locate some data then that's when you exercise your administrative credentials. You don't do it beforehand.

Hi talkingmoose,
Thanks for your reply. But that didn't really answer my question. I work in the school. All students log in MAC using their AD credentials. After they save their work on the Desktop, teachers need to be able to check these files to monitor the progress. That's why I wanted to create a local admin account on each MAC, which will be used by teacher to access other users' folder. I am running 10.6.8 in our environment. All the iMACs have been joined Active Directory. What I find is that the local admin account cannot access other users' home folder. They all have a red minus and when you click on it, it says you do not have permission. This doesn't happen with Root user but does happen with Admin accounts.

I would suggest either having students save in /users/shared or even better saving work to a shared directory that is shared access for student/teacher.

We use MCX to wipe student home directories on logout - so students quickly learn if they don't save in one of these 2 places their work is lost.

My point is that I feel you're handling this issue incorrectly.

The idea behind running as an administrator is that you are still working like a Standard user but can at any time elevate your privileges. If your administrators don't know how to access files that are inaccessible to them in the GUI then they probably don't need to be administrators.

As Sally and I have said, shared folders or server shares are for allowing everyone to share files. User home folders belong to each user. As a best practice they shouldn't be made easily accessible to anyone else including administrators.

We had a similar situation where we had a teacher who was an admin on the lab computers. She would login as root to access students folder to view their work (Video Lab Class). When were started removing admin rights from our teachers she still wanted access to the students' home folders.

We ended up running this at each login to give the teacher access. I'm no expert here but maybe this will work for you.

### Replace USER/GROUP with the actual User or Group
### Replace FOLDER with the actual FOLDER
### Add -R before the +a to make it apply to all folders already in that Folder

chmod +a "USER/GROUP allow read,list,search,add_file,add_subdirectory,delete_child,file_inherit,directory_inherit" FOLDER

Kenny

Thanks guys for your replies. Really appreaciate.
We have a share facility in place. But we want the student work from local because their files are huge, usually 1 to 2 GB. We don't want 25 students editing video from the same share server at the same time. For the same reason, we only use the share drive for students to submit final work. Kids are not patient enough to upload their work to server after every class.
So when the teacher want to monitor their process, he needs to log in to the local computer check student's work. I think for now I will ask the teacher to log in as Root user.
Thanks Kenny for your little trick. I have to test it on Monday. But the problem with AD users is: Even you give full permission to an admin account to access users' home folder, when another new AD user logs in and created a new home folder, it will become unaccessible to the admin again. So you have to start again to use CHMOD.

I would suggest using the admin Dropbox as a submission of work, it's kinda why it is there.

/Users/[adminusername]/Public/Drop Box/

If they drop in the local admins directory, then it isn't a copy to a server and shouldn't take long, although it would obviously be nicer to upload it to the teacher's Dropbox directly.

If a teacher wants to monitor progress, then shouldn't they be doing that with the student there or if the student submits the work? I'd like to think a teacher wouldn't take an exercise book from a students bag to see how they are getting on, but this is equivalent to what you are trying to achieve.

I'm with talkingmoose on this. You shouldn't really be allowing admin access to users accounts. Get the students to submit their work.

Sean

Hello All,

Is there a way to (temporarily) view another user's "Notes Application" files on Macbook Air by login as Administrator?

Thanks