Standard, admin and guest accounts: which one you should use daily
· 5 min read
The first account created on a Mac is an administrator, and most people never create another. That is a reasonable default and it is worth knowing what it means, because the difference between account types is the difference between a mistake being annoying and a mistake being expensive.
What each type can do
Administrator can install software system-wide, change settings that affect everyone, create and delete accounts, and authorise anything by typing a password. Most system changes prompt for it.
Standard can use the machine fully: install applications into their own folder, change their own settings, keep their own files. What they cannot do is change anything affecting other users or the system, without an administrator’s password.
Guest gets a temporary account that is wiped on logout. No password, no persistence, no access to other users’ files.
Sharing Only can reach shared folders over the network and cannot log in at the machine. Rarely needed at home.
The argument for running as standard
It is the same argument as not being logged in as root: most of what you do all day does not need administrator rights, and running with them means a mistake or a malicious installer has nothing to ask.
An administrator account prompted for a password will produce that password from you fairly readily, because prompts are routine. A standard account produces a prompt that is genuinely unusual, which is a better signal.
In practice, for a single-user personal Mac, the benefit is modest. macOS already gates the dangerous operations behind a password prompt and System Integrity Protection blocks a great deal regardless of account type. The gain is real and it is not large.
Where it genuinely matters
A shared family Mac. Children and housemates should be standard. It prevents accidental removal of applications, changes to network settings, and access to other people’s files.
A machine used for work you cannot afford to disrupt. A second standard account for daily use, with the administrator account reserved for maintenance, is a reasonable arrangement.
A machine several people administer. Each administrator should have their own account rather than sharing one, so that changes are attributable.
Setting it up
System Settings, Users & Groups, then Add Account.
The useful pattern for a personal machine is: keep your existing administrator account, create a second standard account for daily use, and move to it. When something needs authorising, you type the administrator name and password at the prompt without switching accounts.
The migration is the awkward part, since your files live in the administrator account’s home folder. Copying them across means going through /Users/Shared or an external drive, because one account cannot read another’s home folder directly.
For most people this is enough friction that the honest answer is: if you are setting up a new Mac, consider it. If you have used one for years, the benefit rarely justifies the move.
Guest accounts
Genuinely useful and underused. System Settings, Users & Groups, Guest User.
Someone needs to check something on a browser, print a document, or use the machine for an hour. A guest account gives them a working Mac with none of your files, and everything they do disappears when they log out.
Note that guest login is disabled while FileVault is on for the login screen, though a guest can still be offered a Safari-only session. Worth testing before you rely on it. Guest mode, and the safest way to lend a Mac for an hour covers the alternatives.
Checking what you are
Quickest way, from Terminal:
id -Gn $(whoami) | tr ' ' '\n' | grep -q '^admin$' && echo "administrator" || echo "standard"
Or System Settings, Users & Groups, where administrators are labelled under their name.
What account type does not protect against
Worth being clear, so the arrangement is not mistaken for more than it is.
A standard account does not stop malware affecting your own files, which are the ones you care about. It stops system-wide changes, not damage within your own home folder.
It also does not stop someone with physical access and time. That is what FileVault is for. FileVault: what it protects you from covers the distinction.
Questions
Can I demote my only administrator account? No, and macOS will prevent it. There must always be at least one administrator. Create a second administrator first, then demote the original.
Do standard users get their own applications?
They can install applications into their own home folder. Installing into /Applications for everyone needs an administrator password.
Does a standard account slow anything down? No. The only difference is the prompts.
Should children have administrator accounts? No. Standard, with Screen Time configured. Setting up a Mac for a child covers doing that without it becoming adversarial.