Deciding who needs what access

The three most common user account levels are

• Admin (administrator): See the preceding section.
• Standard: Perfect for most users, these accounts allow access to just about everything but don’t let the user make drastic changes in Catalina or create new accounts.
• Managed Standard: These accounts are standard accounts with specific limits assigned by you or another admin account, using the Screen Time pane within System Preferences.

Another Mark’s Maxim is in order:

Assign other folks standard-level accounts and then decide whether each new account needs to be modified to restrict access (turning it into a managed standard account). Never assign an account admin-level access unless you deem that access to be truly necessary.™

Standard accounts are quick and easy to set up, and I think they provide the perfect compromise between access and security. You’ll find that standard access allows your users to do just about anything they need to do with minimum hassle.

Managed accounts are highly configurable, so you can make sure that your kids don’t end up trashing the hard drive, sending junk mail, or engaging in unmonitored chatting. (Note: Attention, all parents, teachers, and anyone who designs a single public-access account for a library or organization: This means you.)

Adding users

All right, Mark. Enough pregame jabbering. Show this good reader how to set up new accounts! Your laptop already has one admin-level account (created during the initial Catalina setup process). You need to be logged in to that account to add a user. To add a new account, follow these steps:

1. In the Users & Groups pane of System Preferences, click the New User button (plus sign) at the bottom of the accounts list.

   The empty user record sheet shown in Figure 10-1 appears.

   If the New User button is disabled, and you can’t click it, click the padlock in the bottom-left corner of the System Preferences pane and enter your password to unlock the Users & Groups pane.

2. Choose the access level for this user from the New Account pop-up menu.

   By default, the user receives a standard-level account. You can also choose an administrator account or a sharing-only account.

   The sharing-only account allows the user to copy or open shared files from your MacBook remotely (from another computer), but that user can’t directly log in to your laptop.

3. In the Full Name text box, type the name you want to display for this account (both in the Current User list and on the Login screen); then press Tab to move to the next field.

   macOS automatically generates an account name in the Account Name field for use as your screen and buddy name in Messages and various network applications. The account name is also the name of the folder that macOS creates on the computer’s hard drive for this user. You can keep the default account name or type a new one, but this name can’t contain any spaces.

4. Type the password for the new account; then press Tab.

   Click the button with the key icon next to the Password field, and Catalina is happy to display Password Assistant, complete with a suggestion. Open the Suggestion pop-up menu to see additional suggestions. You can choose the password’s length and choose among several types: letters and numbers, numbers only, memorable, completely random, or even FIPS-181–compatible (government-quality). Password Assistant automatically copies the password you’re considering into the Password and Verify text boxes.

   As always, when you enter or verify a password, macOS displays bullet characters for security.

5. Type the password in the Verify text box, and press Tab.

6. (Optional) If you decide to use the password-hint feature, you can enter a short sentence or question in the Hint text box.

   The hint is displayed after three unsuccessful attempts to enter the account’s password.

   From a security standpoint, password hints are taboo. (I never use ’em. If someone is having a problem logging in to a computer I administer, you’d better believe I want to know why.) Therefore, despite the recommendation that Catalina shows here, I strongly recommend that you skip this field. If you decide to offer a hint, keep it vague! Avoid hints like “Your password is the name of the Wookiee in Star Wars.” And don’t embed the password in the hint!

7. Click the Create User button to finish and create the account.

   The new account shows up in the Current User list and the Login screen.

Each user’s Home folder has the same default subfolders, including Movies, Music, Pictures, Public, and Downloads. A user can create new subfolders within his or her Home folder at any time.

You may want to create a single standard-level account for an entire group of people to use. Perhaps you want to leave the laptop in kiosk mode in one corner of the office, or everyone in a classroom will use the same account on the MacBook. Keep your one admin-level account close to your bosom, and create a standard-level account for the Unwashed Horde. (There’s also an option to create a Guest account if your MacBook will only be used by others infrequently — you’ll find out more in the upcoming sidebar titled, “Working with the Guest account.”)

Here’s one more neat fact about a user’s Home folder: No matter what the account level, most of the contents of a Home folder can’t be viewed by other users. (Yes, that includes admin-level users. This way, everyone who uses your MacBook Pro gets his or her own little area of privacy.) In the Home folder, only the Public folder can be accessed by other users — and only in a limited fashion. (Read all about Home folders in Chapter 3.)

Modifying user accounts

Next, consider the basic modifications you can make to a user account, such as changing existing information or selecting a new picture to represent that user’s unique personality.

To edit an existing account, log in with your admin account, display the System Preferences window, and click Users & Groups to display the account list. Then follow these steps:

1. In the list on the left side of the window, click the account you want to change.

   If the accounts in the list are disabled and you can’t select one, you must unlock the Users & Groups pane. Click the lock in the bottom-left corner of the System Preferences pane, and type your password, if prompted.

2. Edit the settings you need to change.

   Examples include temporarily enabling administrator rights for an account (by selecting the Allow User to Administer This Computer check box) and changing the account password (by clicking the Change Password/Reset Password button).

3. Click the round picture well (the circle that displays the image) to specify the thumbnail image that appears in the Login list next to the account name.

   Apple provides several good images in the preview collection. Just click a thumbnail to select it. You can also drag a new image from a Finder window or the Photos window and drop it into the picture well.

   Note that some of these choices are available only when you’re using an Admin-level account:

   • To choose an image from the default set of macOS icons: Click the picture well, click the Defaults entry at the left (see Figure 10-2), click the desired image, and then click Done.
   • To choose an image from your Photos collection: Click the Photos entry, click the desired image, and then click Done.

   Alternatively, you can click the picture well and then click the Camera entry to grab a picture from your MacBook’s built-in FaceTime HD camera. When you’re set to take the photo, click the camera icon and then click Done to accept it. Most cool. (You can also use Photo Booth to take an account image.)

4. After you make your changes, press ⌘ +Q to save them and close the System Preferences window.

Standard-level users have some control of their accounts; they’re not helpless, after all. Standard users can log in, open System Preferences, and click Users & Groups to change the account password or picture as well as the Contacts Card assigned to them in the Catalina Contacts application. All standard users can also set up login items, which I cover in “Setting up login items and managing access” later in this chapter.

Every account on your MacBook can be customized. Understandably, some settings are accessible only to admin-level accounts, and others can be adjusted by standard-level accounts. In the following sections, I introduce you to the things that can be enabled (or disabled) in a user account.

Note, however, that managed users may not have access to Account Settings, so they can’t make changes. (Read about this topic in the upcoming section “Managing an account’s access settings.”)

I banish thee, mischievous user!

Not all user accounts last forever. Students graduate, co-workers quit, kids move out of the house (at last!), and Bob might even find a significant other who has a faster broadband connection. We can only hope.

Anyway, no matter what the reason, you can delete a user account at any time. Log in with your admin account, display the Users & Groups pane in System Preferences, and then follow these steps to eradicate an account:

1. In the user list on the left side of the window, click the account you want to delete.

2. Click the Delete User button (which bears the Minus Sign of Doom).

   macOS displays the confirmation sheet shown in Figure 10-3.

   Note that the contents of the user’s Home folder can be saved as a disk image in the Deleted Users folder (just in case you need to retrieve something). Alternatively, you can choose to leave the deleted user’s Home folder as is, without removing it, but naturally you won’t regain any space, even though the user account is deleted.

   If you’re absolutely sure that you won’t be dating that person again, select the Delete the Home Folder radio button (which doesn’t save anything in the Deleted Users folder). You regain all the drive space that was being occupied by the contents of the deleted user’s Home folder.

3. To delete the account, click Delete User; if you’re not sure, click the Cancel button to abort and return to the Accounts list.

Time once again for a Mark’s Maxim:

Always delete unnecessary user accounts. Otherwise, you’re leaving holes in your laptop’s security.™

Setting up login items and managing access

Every account on your MacBook can be customized. Understandably, some settings are accessible only to admin-level accounts, and others can be adjusted by standard-level accounts. In the following sections, I introduce you to the things that can be enabled (or disabled) in a user account.

Automating with login items

Login items are applications or documents that can be set to launch or load automatically as soon as a specific user logs in, such as Apple Mail or Contacts. In fact, a user must be logged in to add or remove login items. Even an admin-level account can’t change the login items for another user.

A user must have access to the Users & Groups pane in System Preferences to use login items. As you see in the following section, a user can be locked out of System Preferences, which makes it more difficult for login items to be deleted for that account. (Go figure.) Therefore, if the account is managed and access to System Preferences has been turned off, an administrator must enable the account’s access to System Preferences, allowing the managed user to delete login items.

To set login items for your account, follow these steps:

1. Click the System Preferences icon on the Dock and then click the Users & Groups icon.

2. Click the Login Items tab to display the settings shown in Figure 10-4.

   It bears repeating: You can change the Login Items for only the account that’s currently logged in, so be sure that the desired account appears below the Current User heading in the list on the left side of the dialog.

3. Click the Add button (with the plus sign) to display a file-selection sheet.

4. Navigate to the application you want to launch each time you log in, click it to select it, and then click Add.

   If you’re in the mood to drag and drop, just drag the applications you want to add from a Finder window and drop them directly into the list.

5. Press ⌘ +Q to quit System Preferences and save your changes.

If the application is running at the moment, you can take an easy shortcut to avoid these steps: Simply right-click the application icon on the Dock and choose Options ⇒   Open at Login from the shortcut menu.

Login items are launched in the order in which they appear in the list, so feel free to drag the items into any order you like.

It’s a good idea to limit the amount of login items, especially on older MacBooks. Login items may be automatic and convenient, but too many of them can dramatically slow the boot process each time you start your laptop. No one wants to wait 3 minutes before starting to work or play!

Managing an account’s access settings

A standard-level account with restrictions is a managed account. (You can read about these accounts in “Big-Shot Administrator Stuff” earlier in this chapter.) With these accounts, you can restrict access to many places in Catalina and your laptop’s applications. Note that you can use Screen Time with your administrator account as well, but your account will still be labeled Admin on the Users & Groups pane of System Preferences.

In short, managed accounts come in handy for preventing users — family members, students, co-workers, friends, or the public at large — from damaging your files, your software, or macOS Catalina itself. If an account has been restricted, the account description changes from Standard to Managed in the Accounts list.

To display the access controls for a standard account, start here:

1. Log in, using your Administrator account.

2. Open System Preferences, and click the Screen Time icon.

   The Screen Time pane appears.

3. Click the Options item at the bottom of the list on the left side of the pane.
4. Click the Turn On button in the top-right corner of the pane to enable Screen Time.
5. Click the Use Screen Time Passcode check box to enable it, and specify a passcode when prompted.
6. Click the red Close button in the top-left corner of System Preferences to close the window and save your changes.
7. Log in, using the account you want to manage (by logging out of your administrator account or using Fast User Switching).

8. Select Downtime on the left side of the pane to display the schedule settings shown in Figure 10-5.

   To set a downtime schedule, click the Turn On button in the top-right section of the pane; then use the controls on the right side of the pane to specify whether the schedule applies every day or on a specified range of days. Catalina restricts the use of your laptop according to your settings.

9. Select App Limits on the left side of the pane to limit the time spent on specified applications.

   When you click the Turn On button in the top-right section of the pane, you can limit the use of all applications to a certain amount of time or click the Add button (which bears a plus sign) to specify certain applications to add to the list. To change the amount of time allowed, click the application to select it and then click Edit Limit. To remove a limited application, click it to select it and then click the Delete button (which bears a minus sign).

10. Click Always Allowed on the left side of the pane to specify applications and Contact entries that can be used at any time.

    The selected applications and Contacts entries will always be available, even during downtime (and after limits on application use have been reached).

11. Click Communication on the left side of the pane to limit communications with others using iPhone, FaceTime, Messages, and AirDrop.

    You can prevent people who are not included in the user’s Contact list from communicating, as well as restrict communications during the downtime period you set in Step 8.

12. Click Content & Privacy on the left side of the pane to set restrictions on purchases through Apple Stores as well as age-appropriate content.

13. Click the Stores tab of the Content & Privacy pane, and make the desired changes.

    Specify whether the user can use the iTunes Store and the Book Store, and (if desired) restrict the user’s ability to install applications, delete applications, or authorize in-app purchases.

14. Click the Content tab of the Content & Privacy pane (shown in Figure 10-6) to choose ratings limits.

    Ratings limits are available for applications, movies, TV shows, books, and music across all the content available in Catalina. (This feature is some powerful stuff, parents!) Catalina offers three levels of control for websites from this screen:

    • Unrestricted Access: Select this radio button to allow unfettered access for this user.
    • Limit Adult Websites: You can allow Safari to automatically block websites that it deems to be adult. To specify sites that the automatic “adult filter” should allow or deny, click the Customize button.
    • Allowed Websites Only: Choose this radio button to specify which websites the user can view. To add a website, click the Customize button, click the Add (plus sign) button, and respond to the prompt for a title and the website address.

15. Click the Other tab to set restrictions on a range of Catalina features.

    Take note: If you want to prevent the user from removing the restrictions you’ve set within Screen Time, don’t forget to disable the Account Changes check box on the Other tab! (Disabling this check box locks the settings throughout Screen Time, requiring the passcode you set up in Step 5 to unlock them.)

16. Click the red Close button in the top-left corner of System Preferences to close the window and save your changes.

You can always tell whether an account has been assigned restrictions, because the account description changes from Standard to Managed in the User list.

Would you like to set up a public-access MacBook? You can also change the Automatic Login account from the Users & Groups pane. Click the Login Options button in the User list, click the Automatic Login pop-up menu, and choose the account that automatically logs in when macOS starts. On the confirmation sheet that appears, enter the account’s password, and click OK. I’ve made it clear elsewhere that Automatic Login is not a good security feature in many cases, such as with a laptop on the road, but it can be a good feature if you’re preparing a MacBook for public use. If you set Automatic Login to your public standard-access account, macOS automatically uses the correct account if the Mac is rebooted or restarted.

You can always choose  ⇒   Log Out to log in under your own account, or use the Fast User Switching feature, which I describe in the next section.

Logging in and out of Catalina For Dummies

Hey, how about the login screen itself? How do your users identify themselves? It’s time for another of my “shortest books in the For Dummies series” special editions. (The title is practically longer than the entire book.)

Exploring your login options

Catalina offers four methods of logging folks in to your multiuser laptop, all of which you can access by clicking the Login Options button in any admin account:

• Username and password login: This screen is the most secure type of login screen you’ll see in Catalina, requiring you to type your account username and password. (A typical hacker won’t know all the usernames on your MacBook.) Press Return to complete the process.

  When you enter your password, you see bullets rather than your password because Catalina displays bullet characters to ensure security. Otherwise, someone could look over your shoulder and see your password.

• Keep your laptop secure: Use a username and password login, and always choose a password that’s tough to guess.™

• List login: This login screen offers a good middle of the road between security and convenience. Click your account image in the list, and type your password when the login screen displays the password prompt. Press Return to continue.

• Fast User Switching: This feature allows another user to log in while the previous user’s applications are still running in the background. This feature is perfect for a fast email check or a scan of your eBay bids without forcing someone else off the MacBook. When you turn on Fast User Switching, Catalina displays the active user’s name at the right end of the Finder menu bar.

  To switch to another account:

  1. Click the current user’s name in the Finder menu (see Figure 10-7).
  2. Choose the name of the user who wants to log in.

  Catalina displays the login window, just as though the laptop had been rebooted.

  The previous user’s stuff is still running, so you definitely shouldn’t reboot or shut down the computer!

  To switch back to the previous user:

  1. Click the username on the Finder menu again.
  2. Choose the previous user’s name.

  For security, Catalina prompts you for that account’s login password.

• Auto Login: This option is the most convenient method of logging in but offers no security whatsoever. Catalina automatically logs in the specified account when you start or reboot your MacBook.

  I strongly recommend that you use Auto Login only if

  • Your laptop is in a secure location, such as your home or a locked office. If you’re on the road, you and your data need the protection of a username and password login!
  • You can guarantee that you’re the only one using your laptop. Period.
  • You’re setting up a public-access laptop kiosk, in which case you want your MacBook to log in with the public account.

  Working in a public environment? Never set an admin-level account as the Auto Login account. This is the very definition of an SDI (Supremely Dumb Idea).

Changing your login settings

To set up a username/password or list login, open System Preferences; click the Users & Groups icon; and then display the Login Options settings in the Users & Groups pane, as shown in Figure 10-8. (If necessary, click the lock icon in the bottom-left corner to confirm your access.)

Here’s a rundown of key login settings:

• Automatic Login: To set Auto Login, click the Automatic Login pop-up menu and choose the account that Catalina should use.
• Display Login Window As: Select the List of Users radio button for a list login screen, or select the Name and Password radio button to require your users to type their full usernames and passwords.
• Show Fast User Switching Menu As: Select this check box to enable Fast User Switching. Click the pop-up menu to specify how accounts should appear on the Finder menu (as full names, short names, or account icons).

Interesting stuff about sharing stuff

You may wonder where shared documents and files reside on your MacBook. That’s a good question. Like just about everything in Catalina, the answer is simple: The Users folder on your laptop has a Shared folder within it. To share a file or folder, place it in the Shared folder.

You don’t have to turn on file sharing in the Sharing pane of System Preferences to use Shared folders on your laptop. File sharing affects only network access to your machine by users of other computers.

Each user account on your MacBook also has a Public folder in that user’s Home folder. The Public folder is a read-only folder that other users on your laptop (and across the network) can access. They can only open and copy the files it contains. (Sorry, they can’t create new documents or change existing documents created by other users.)

Encrypting your Home folder can be fun

Allowing others to use your Mac laptop always incurs a risk — especially if you store sensitive information and documents on your computer. Although your login password should ensure that your Home folder is off limits to everyone else, consider adding an extra level of security to prevent even dedicated hackers from accessing your stuff. Have one forgetful moment in an airport or classroom, and your personal and business data is suddenly within someone else’s reach. Adequate security is a Supremely Good Thing!

To this end, Catalina includes FileVault, which automatically encrypts the contents of your MacBook’s drive. Without the proper key (in this case, your login password, your Apple ID, or the FileVault recovery key), the data stored on your drive is impossible for just about anyone to read. (I guess that the FBI or CIA would be able to decrypt it, but they’re not likely to be problems at your place!)

The nice thing about FileVault is that it’s transparent to you and your users. In other words, when you log in, Catalina automatically decrypts your encrypted files and folders. You won’t know that FileVault is on the job (which is how computers are supposed to work).

To turn on FileVault protection for a specific account, follow these steps:

1. Click the System Preferences icon on the Dock and then click the Security & Privacy icon.
2. On the Security & Privacy pane, click the FileVault tab.
3. Click the Turn On FileVault button.

4. Specify whether your iCloud (Apple ID) account can be used to reset your password and unlock your disk; then click Continue.

   For most MacBook owners, the Allow My iCloud Account to Unlock My Disk option is probably fine, but if you’re security-conscious, or if you’ve shared your iCloud account information with others, click the radio button titled Create a Recovery Key and Do Not Use My iCloud Account.

5. If you decide to create a separate recovery key, write down the FileVault recovery key displayed by Catalina, and store it in a safe place.

   To avoid making mistakes, you can capture an image of your screen by pressing ⌘ +Shift+3. The screen shot appears on your Desktop as an image file. You can open that file and print a copy, or even copy an image file to a USB flash drive or another computer on your network for safekeeping. (Naturally, you’ll delete the image after it’s been printed or copied elsewhere.)

   I love the FileVault feature and use it on all my Macs running Catalina. Yet a risk is involved (insert ominous chord here). To wit: Do not forget your login and iCloud account passwords (or make DOGGONE sure that you or your Admin user has access to a copy of that all-important FileVault recovery key)! macOS displays a dire warning for anyone who’s considering using FileVault: If you forget these safeguards, you can’t retrieve any data from your MacBook’s drive. Even the smartest Apple support technician will tell you that nothing can be done. As Jerry Reed used to say, “It’s a gone pecan” (with pecan pronounced Southern style, as “puh-kahn”).

6. If necessary, click Enable User, provide the login password for each user on your account, and then click Continue.

   Each user on your MacBook has to be enabled to use your laptop after FileVault has been turned on. If you don’t know the login passwords for the other user accounts on your system, you have to ask each person to provide his or her password to continue. (If an account isn’t enabled, that person can’t access anything on the hard drive after it’s been encrypted.)

7. Click the Restart button on the confirmation screen.

   Your MacBook automatically reboots and begins the encryption process. You can continue to use your laptop normally during encryption.

You’re done!