Require Admin Password to Install any Application on a Mac
Configure a Mac to always require admin approval before any application can be downloaded, no matter where it's downloaded from (Safari or App Store).
If you are a parent who's setting up a Mac computer for your child, an important step is control which applications can be installed. The best way to do this is to require parental approval for each new application that is downloaded. Fortunately, it's possible to always require admin approval to download an application, no matter if it's downloaded form the App Store or directly from a website via a web browser like Safari.
On Mac, you have to take into account two separate ways apps could be installed:
- The app could be downloaded from the App Store application
- The application could be downloaded directly from a website using Safari; usually, a
.dmgor.pkgfile runs an installer
Apple's parental control solution (Screen Time) doesn't provide the customization required to fully lock down both download sources (only the App Store), but we've found a reliable path forward that parents can use to reliably gate applications behind an admin password.
Prerequisites
First, you'll need to have physical access to the Mac to initially set it up.
As part of setting up the Mac, you will be creating a login for yourself that only you should know the password to. Part of the reason why is that there needs to be at least one Admin user on the Mac at any given time, and Admins are the only kind of users who could override your setup later.
There are two specific settings that you are going to modify: one to disable apps from being downloaded from the App Store and another to restrict applications from being installed if they've been downloaded. While both of these methods are different, there is a better way to enable both of them that I'll cover later in this guide called Config Files , which basically allows you to enable both for all users on the Mac at once. Config Files are also much more difficult to remove and automatically apply these restrictions to new users who are created on the Mac.
(1) Set Up Non-Admin Accounts on Mac
First, you'll need to create an Admin login on the Mac you're setting up and ensure that your child's login is marked as a standard user. For this example, I want to have two logins on my Mac: an admin login for "John Smith" and a standard user for "Johnny", whom I'm setting the Mac up for.
If you're logged in with any login, view account information by opening System Settings and going to Users & Groups. You should see a full list of user logins (or users) on that Mac.
First, find your child's login. In my case, it's "Johnny Smith". Notice that this account is an admin (new accounts are by default). You should go ahead and change this by clicking on the "i" icon next to their name.
What if there isn't a log in for my child yet?
In some cases (such as if you're starting with a new Mac), you may need to create a login for your child. Select the "Add User" button and ensure that you create a login for your child that is a Standard user.
What if my child has a login already?
First, find your own login (or make a new one for yourself). You can use your own name; in this example, "John Smith" is the parent, and "Johnny Smith" is the child.
Confirm that your own login is an admin. If not, you'll need to log out of your Mac and then log in as the admin user. You should then be able to select your own login (John Smith is our example) by selecting the "i" icon like this:
From here, toggle on "Allow this user to administer this computer":
Provide the admin login (that user's name and password):
Once confirmed, you'll see a message that tells you the change requires a restart:
Restart the Mac to apply changes, and when you check the Users & Groups page, you should be listed as an admin.
Disable the Guest User
You may also want to disable the Guest user, although it's not normally possible for guest users to install applications with Admin credentials.
(2) Require Admin Passcode to Install Non-App Store Applications
Unfortunately, without disabling Safari and all other web browsers, it's not really possible to block a .dmg or .pkg file from being downloaded to the Mac, so what we're going to do instead is prevent those files from being run without logging in as an Admin.
Normally, when an installer is downloaded and run, you might see something similar to this at some point:
What you can do is modify Security settings so that continuing to install prompts for an Admin login, like this:
The best (and easiest) way to enable this is by using Apple Config Files, which basically tell your Mac to enforce certain restrictions across the entire device and all users automatically.
If you're a Tech Lockdown member, look for the App Installations section of the Config Generator, and toggle off "Allow app installations from outside of the App Store":
Optionally, if you want to automatically block normal app installations and the App Store at the same time, switch App Installation to "Allow only approved apps", like this (I'll explain how to do this manually in the next section of this guide):
Once you've configured your config as desired, sync the config to your device.
You absolutely can enable similar restrictions without Config Files, but you'll need to log in as an Admin user on that Mac.
Manually disable app installation
First, confirm that you are logged in as an Admin on your Mac. Open System Settings and go to Privacy & Security.
Scroll down to the Security section. You should see an option called Allow applications from.
Make sure Allow applications from is set to "App Store", and enter your Mac's login info to proceed.
Note that any Admin user can disable this feature if they know what to look for, so we strongly recommend Config Files as they more difficult to remove.
(3) Require Admin Passcode to Download Apps from the App Store
The last step is to block the App Store from installing apps, which should completely restrict the Mac.
If you're using Tech Lockdown's Config Generator , manage the App Store under the "App Installation" section. Here, you can set a maximum age rating for the kinds of apps that can be downloaded from the App Store, or just disable the App Store entirely.
Now, this is possible to do manually, but note that it needs to be done for each Apple account with a login on that Mac because it involves setting up Screen Time. This is where it might help to enable Apple Family Sharing if you'd like to manage Screen Time for your child's Apple account, but you can also set it up manually if you're logged in as your child's user.
Check our dedicated guide for disabling the App Store on Mac for a full walkthrough.
Frequently Asked Questions
Why do I need to create a login for myself on my child's Mac?
On MacOS, there always needs to be one Admin user, although you can have as many standard users as your have space for.
Why can't my child be have an Admin login?
To fully prevent new applications from being installed, it's necessary to convert a child's login to a standard user account because it's not possible to block your child from making changes otherwise.
An Admin user can always bypass Screen Time restrictions (even if you've set a Screen Time passcode), but they can also reset pretty much any setting you've previously set up for them in System Settings.