Restrict Password Change

[FlameCoder]

I want to restrict password change in El Capitan. In 10.8 this was done on the parental control "Others" tab. This option is no longer there in 10.11. Is there a terminal command to restrict managed accounts from changing their passwords?

 

[JohnDS]

Perhaps you could use the Disallow Apps setting to disallow access to the System Preferences.

 

[FlameCoder]

No, users need access to some system preferences.

 

[KALLT]

I’ve had a look at how this works on Mavericks. Enabling that setting creates a property list (plist) file at /Library/Managed Preferences/Username/com.apple.systempreferences.plist. You could try to create/add this file manually and see whether it still works. I have attached it for you. You can also create it yourself with these contents:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.preference.myaccount</key>
    <array>
      <string>ChangePassword</string>
    </array>
  </dict>
</plist>

There is also another plist file there called ‘complete.plist’ which contains all the options again. You might need to update that one too. You can edit this file with a code editor (preferably not a rich-text editor), like Atom. You should add this section, but you need to copy the line that begins with ‘mxc_users’ manually from another entry.

<dict>
  <key>com.apple.preference.myaccount</key>
  <dict>
    <key>mcxdomain</key>
    <string>always</string>
    <key>source</key>
    <array>
      <string>mcx_user_USERNAME_SOME_UUID</string>
    </array>
    <key>value</key>
    <array>
      <string>ChangePassword</string>
    </array>
  </dict>
</dict>

I do not know whether this works though. My guess is that the setting will be overwritten.