Master Mac parental controls
Use your Mac’s built-in tools to make sure your kids have a safe experience when you can’t be there.
There’s no substitute for sitting with your child when they’re using a computer to make sure they don’t see or do anything that might be harmful. However, what parent hasn’t been forced to divide their time between their kids and household chores? As your kids grow older, they may also deserve a certain amount of privacy when using the family Mac, too.
Fortunately, macOS offers the next best thing to watching over your kids’ shoulders: the use of parental controls. These can be configured by creating managed user accounts for your children, and you can then enable or disable specific features. For instance, you may choose to disable the webcam and iTunes Store altogether, or set time limits on when the Mac can be used. Parental controls also includes ‘whitelists’ and ‘ blacklists’ for websites and apps to make sure your children are accessing only age-appropriate content. The settings are smart and you can make exceptions on a caseby-case basis.
In this guide, you’ll learn how to set up managed accounts for your children, as well as how to tailor the parental control options as you see fit. You’ll also discover some common ways tech-savvy kids try to circumvent parental controls, and how you can reduce the chance of this happening.
Master parental controls on Mac LEARN THE BASICS OF ACCESSING AND CONFIGURING PARENTAL CONTROLS FROM SYSTEM PREFERENCES.
The account you initially set up in your own name on your Mac is an administrator account. Admins can make system-wide changes, such as installing new software. You can use this account to manage the parental controls that are applied to other accounts. You can also set up managed user accounts, from which users can
“You can limit the overall time a child can spend logged in. You can also prevent them from logging in at certain times.”
only access apps and content that you specify.
If your kids already have an account on the Mac, follow the steps in the guide below to convert their user account to a managed one. If you’re setting up your Mac for the first time, or you and your children currently share a user account, follow the steps at apple.co/2q71m1i to create a managed account from scratch.
MISCHIEF MANAGED
Once a managed account has been set up, click ‘Open Parental Controls’ (bottom right of ‘Users & Groups’). Later on, you can go to ‘System Preferences > Parental Controls’. Access to the parental controls pane requires an administrator account’s details to be entered.
In this pane, you can work through the options in the various tabs to decide what level of access is right for your child. By default, the Apps tab is selected. The first option here disables all webcams — the Mac’s built-in FaceTime camera and any external ones you connect. Like all other settings, if your child needs to enable this for a special purpose, you can do so from their account by entering your admin password on a one-time basis.
The second option determines whether or not your child can join multiplayer games that use Apple’s Game Center platform. Bear in mind that not all games you install will make use of this — they may use other technologies to facilitate multiplayer gaming — but you can further restrict individual apps if you want.
Put a tick next to the third option, then click ‘Manage’ to set up a preapproved whitelist of contacts with whom your child is allowed to exchange emails. This restriction applies only to the Mail app itself, not to webmail services, but you can filter websites, too.
Enable ‘Limit Applications on this Mac’ to ensure your child can only open apps on a pre-approved list. This is on an opt-in basis, meaning you must specifically approve each app by ticking the box next to it. Use the search box to quickly find apps you want your child to be able to use.
Click the Web tab to configure browser restrictions. By default, standard and administrator user accounts on a Mac are allowed unrestricted access to websites. Select ‘Try to limit access to adult websites’ and click ‘Customise’ to specifically list which websites are allowed and which should be blocked. If you have very young children, you may prefer the third option which limits web access to a select list of child-friendly sites. You can explicitly add more sites using the ‘+’ button. These restrictions will apply no matter what browser your child is using.
In the Stores tab, you can block your kids’ access to the iTunes Store, iTunes U and the iBooks Store. If this seems like overkill, use the other options, which enable you to filter music with explicit content or enforce the age limit on movies, TV shows and apps. You can even block books
“If you haven’t set up explicit app restrictions, gifted kids may try to install ‘portable’ apps to an external drive and run them from there.”
that are marked as having explicit content.
SET TIMES
If you’re not so much worried about the content your child accesses as how long they spend in front of a computer, click the Time tab. You can limit the overall time a child can spend logged in. You can also prevent them from logging in at certain times, such as after 8pm on a school night.
Certain apps require access to data on your Mac such as Contacts and Calendar. Go to the Privacy tab to disallow access to anything, such as Twitter and Facebook, to which you think apps don’t need access. There is no harm unchecking all of these, as you can always re-enable them later.
While in your checkbox frenzy, head to the Other tab and tick all the options there, too. This will turn off Siri, prevent your child burning DVDs without your permission, and display a simplified version of the Finder which is much harder to hack.
Hacking parental controls LEARN ABOUT THE WORKAROUNDS FOR PARENTAL CONTROLS THAT YOUR LITTLE DARLINGS MAY TRY.
You may well encounter some resistance to setting up parental controls. Fortunately, macOS allows you to tailor the operations kids can perform, according to how responsible they are.
Some kids may decide, however, to take to the internet in an attempt to find out how to bypass these controls, and indeed there are a number of websites devoted to getting around the restrictions you’ve just set up.
The security of the restrictions depends on you keeping your user account password safe, so be sure to change it if your child used to share your account, or if you suspect they may know it. Make sure to do the same for any other admin accounts.
Your child’s next best option if they want to undermine parental controls is to try to create a new, hidden admin account, so they can log in to the Mac and have unrestricted use.
TECH-SAVVY KIDS
There are several ways to create a new admin account, such as enabling the root account, or restarting in singleuser mode and entering the necessary commands. Once this is done, a techsavvy kid will most likely hide the account so it doesn’t appear in the / Users folder, nor in ‘System Preferences > Users & Groups’. Follow the steps opposite to make sure your child hasn’t done this. Next, consider setting a firmware password (see next page). This password prevents anyone starting up the Mac in single-user mode to enter commands that create a new account or otherwise interfere with your parental controls. If you do choose to set a firmware password, this will also be required each time you want to start up in macOS Recovery, in which the ‘root’ account can be enabled and passwords reset.
Another option your child may try is to install another operating system, such as Ubuntu Linux, on a flash drive and start up from this. As the system would load from that drive into memory, no trace of your child’s activities would be left on the Mac. You can prevent starting up from external drives without first entering the firmware password by following the steps on the right. Write down the firmware password and keep it safe; if you forget it, you’ll need to take your Mac to an Apple Store or Authorised Service Provider to reset it.
SMOKE AND MIRRORS
Should your kids find they’re unable to create an admin account on the Mac or start up in another operating system, they may try to find workarounds within macOS itself.
In ‘System Preferences > Users & Groups’, make sure the Guest account is disabled, as parental controls will not log any activity there.
If you haven’t set up explicit app restrictions, gifted kids may try to install ‘portable’ apps to an external drive and run them from there. You can prevent access to external drives by choosing the ‘Simple Finder’ option in the parental controls pane’s