By Glenn Fleishman

August 25, 2025 7:46 AM PT

Demote a macOS administrator to a standard user

Tear those epaulettes off one of your admin accounts in macOS. It knows what it did! And what’s that? It’s just too darned powerful. An account marked as an administrator can carry out nearly every operation—probably every operation—on your Mac during an active session.

Six Colors reader Bob writes in with a question about that:¹

Back in the Mac OS 9 days, I had a single user account (“Bartleby”), which had administrator privileges by default. Once I entered the OS X era, I kept the account as-is, but I added additional administrator accounts as fallbacks. Many years of inertia have gotten me to macOS 12 while still using my main account as an admin account, but I would prefer not to.

I’m planning to upgrade my Mac soon, and it seems like a good time to demote Bartleby from admin to standard. I’d use one of the other administrator accounts’ credentials when admin privileges are needed. Are there any issues that might arise if I remove admin status from that original Bartleby account?

One of the joys of answering questions is that I encounter issues I’ve never written about before. There are factors to weight with account privileges before you eject a Bartleby from his administrative post, starving him of his power.

Account types in macOS

Let’s do a quick review of account types, something that’s remained fairly static in macOS for many years. There are four main types of Mac user accounts: administrator, standard, guest user, and sharing-only. Of these, administrator and standard are by far the most common. The usual reason to have more than one account is so that each person who uses a particular Mac can have a separate space for files and settings. But accounts can also be used to restrict access to certain files or resources in order to improve your security.

Every Mac needs at least one administrator account. When you set up a new Mac or perform a clean installation of macOS, you are be prompted to create an administrator account before you can do anything else. That’s because only administrators can perform certain crucial tasks. You can have more than one administrator account. In some cases, you may want to set up an extra one to use for testing and troubleshooting.

The risk is that administrator accounts are all-powerful. Administrators can create, modify, and delete other user accounts. They can unlock any pane of System Settings, and authorize any type of software installation. They can (with a quick trip to the Terminal utility) open any file on the Mac, belonging to any user—and can change any non–system file’s permissions. They can upgrade macOS to a new version. The list goes on and on.

So not only is an administrator account overkill for users on a Mac who don’t need such privileges, it can be a toehold for a naive user to grant permission to the few pieces of malware that successfully target Macs. If someone with an administrator account launches an app, that app has more expansive access to files on the Mac, although Apple’s sandboxing limits that scope somewhat.² A malicious or compromised app launched by someone with an administrator account might be able to do serious damage across the Mac.

Even sophisticated users may want to work in the constraints of a standard app, because you can get most things done. Standard users can run apps, work with files, and perform most ordinary day-to-day tasks. When you or another user with a standard account tries to do something that only an administrator is allowed to do, simply entering an administrator’s username and password (or having an administrator do so) does the trick—there’s no need to log out or switch accounts first.

So you can downgrade your primary account to a standard one as long as you have an administrator account that you may rarely log into, but which you invoke when you need those privileges.

Turn down the power

If you’re ready to adjust your settings, here’s what to do:

• Start by making sure you have a working administrator account that you can log into. You want to be absolutely positive that this is functional before you downgrade another account.³
• Make sure there’s nothing that relies on the account you plan to downgrade that needs administrator privileges, though those tend to be specialized items, like scripts or crontab entries that run in the background.
• Are there files or folders that you’re using administrator privileges to access? With permissions still intact, it’s much easier to move files into locations that your user account will have access to, and to use File > Get Info with files or folders selected to make sure that you have the permissions you need as that user. (You can fix this later, too.)

Now, follow these steps:

1. Log out of your standard account. ( > Log Out User Name.)
2. Log into the administrator account you’ll use in the future for authorizations as needed.
3. Go to  > System Settings > Users & Groups.
4. Click the info icon to the right of the your logged-out user’s name.
5. Disable “Allow this user to administer this computer.”
6. Enter the current administrator user’s name and password and click Unlock.
7. Click OK at the dialog that notes “You must restart the computer for your changes to User Name‘s administrator settings to take effect.”
8. Restart your Mac.
9. Log into your now reduced-in-power main user.

If you’ve used a Mac for a while, you might recall that, with FileVault enabled, you may need to enable this new downgraded user to have permission to log in from a “cold start” (power off) or restart. Check  > System Settings > Privacy & Security > FileVault. Apple says you might see an Enable Users button with FileVault turned on. If so, click it, and make sure that your demoted user is authenticated for FileVault logins.

Now you’re set! See if you can get “Bartleby” to work.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

[Glenn Fleishman is a printing and comics historian, Jeopardy champion, and serial Kickstarterer. His latest books are Six Centuries of Type & Printing (Aperiodical LLC) and How Comics Are Made (Andrews McMeel Publishing).]

If you appreciate articles like this one, support us by becoming a Six Colors subscriber. Subscribers get access to an exclusive podcast, members-only stories, and a special community.