Mac Forum / Applications / Mac Applications / February 2005

AFAIK, the only thing that distinguishes an admin account from any other
kind of account is that it's a member of the admin group. It's that
group membership that confers the power "to administer this computer".

Any member of group "admin" is an administrator.

When you boot a Mac for the very first time, you are asked for a user ID
and password that will be used to create the first account, which is
always an admin account.

In order to add or delete accounts (admin or not) you must be logged in
as an admin user.  However, you cannot delete the account of any user who
is currently logged in.  Therefore, it is not possible to delete all the
admin accounts.

Taking from my old unix days--All accounts are really "user
accounts". An Admin account is a special type of user account. In
addition to belonging to the "admin" group, it has some of the
administrative powers of a superuser (e.g., the ability to change
other people's passwords even if they have nothing to do with the
admin group.

Some types of unix services actually have their own accounts as
well but nobody actually logs into them. They are for processes
that are set up so that if something goes nuts or is hijacked,
other processes in the system are protected from them.

There is always at least one user account and that is the
superuser. However and admin can do nearly anything a superuser
can do only they tendto have to keep entering their password all
the time. Once logged in as superuser, this usually is not
necessary. The superuser account is disabled in OS X but it can
be enabled for certain tasks but most Unix admins will tell you
it is almost always better to have admin account and the sudo
type commands to accoumplich superuser activities than to
actually log in as the superuser.

BTW, i forget the actual values, but superuser is either userID
number 0 or 1. Admins are all users with userIDs that are less
than a certain value (again I forget the value used). Normally in
the Mac you never see the userID number but if you go into the
terminal window and do a long listing on files in your home
directory (e.g., "ls -l") the numberic values for you as a user
(your userID) and your group (your groupID) are visible on each
file. When you do a get info on a file or folder in the finder
and look at the permissions, those numberic values are mapped
into the text values of your account name and group name.

- Jeff

Yes.  The admin account is allowed to interfere with system-level
files, where a "joe user" account can only break their own stuff.

Yes, unless you want to run the stock Apple install forever, chances
are you'll need admin rights at some point.  The first account
you create is automatically granted those rights, which are need to
add more accounts and so on.

It's more complicated than that, but this is fundamentally accurate.

Dave Hinz