Skip to main content

I'd like to find a way to allow users to change the following things, either without a password or using their own, instead of needing admin rights.

  • Power settings, like how long before turning off the display on battery or power adapter
  • Network settings, like changing wi-fi networks Auto-Join setting
  • Printing settings, like updating Options and Supplies (this only started asking for an admin password since I think Ventura)
  • Privacy and Security, like adding an app to Accessibility.

Does anybody know a good way to do this? I wish the config profiles were a bit more like GPOs in this regard because I suspect I need a script instead of a checkbox.

This sort of thing can be achieved by manipulating the SQL database stored at:

/var/db/auth.db

However the is not the recommended way to do this. The proper and supported way is to use the security authorization command and switches.

Hope that helps.

M

 

This sort of thing can be achieved by manipulating the SQL database stored at:

/var/db/auth.db

However the is not the recommended way to do this. The proper and supported way is to use the security authorization command and switches.

Hope that helps.

M

 


@mschlosser wrote:

The proper and supported way is to use the security authorization command and switches.

Can you expand on this? Or do you just mean using admin credentials when clicking the padlock on the settings pages?

@mschlosser wrote:

The proper and supported way is to use the security authorization command and switches.

Can you expand on this? Or do you just mean using admin credentials when clicking the padlock on the settings pages?


more info is available here:

https://scriptingosx.com/2018/05/demystifying-root-on-macos-part-4-the-authorization-database/#:~:text=The%20active%20authorization%20database%20lives,to%20read%20the%20database%20directly.&text=You%20can%20use%20this%20database%20access%20to%20change%20the%20settings%20directly.

 

Also man security is a decent read in terminal.

 

@mschlosser wrote:

The proper and supported way is to use the security authorization command and switches.

Can you expand on this? Or do you just mean using admin credentials when clicking the padlock on the settings pages?


I'm using something like this 

/usr/bin/security authorizationdb write system.preferences.network allow

 

more info is available here:

https://scriptingosx.com/2018/05/demystifying-root-on-macos-part-4-the-authorization-database/#:~:text=The%20active%20authorization%20database%20lives,to%20read%20the%20database%20directly.&text=You%20can%20use%20this%20database%20access%20to%20change%20the%20settings%20directly.

 

Also man security is a decent read in terminal.

 


I've got a script going, but at least in Sonoma and Ventura, none of it seems to be taking effect. Anything I'm missing here, or are things just broken in the newer OSes?

#!/bin/sh

#system preferences
security authorizationdb write system.preferences.network authenticate-session-owner-or-admin
security authorizationdb write system.preferences.accessibility authenticate-session-owner-or-admin
security authorizationdb write system.preferences.energysaver allow
security authorizationdb write system.preferences.printing allow
security authorizationdb write system.preferences.datetime authenticate-session-owner-or-admin

#Printing
security authorizationdb write system.printingmanager allow
security authorizationdb write system.print.admin allow
security authorizationdb write system.print.operator allow

#potential force restart and shutdown if other users logged in
security authorizationdb write system.restart allow
security authorizationdb write system.shutdown allow

exit 0
Terms & ConditionsCookie settings