Restricting macOS settings for a child's account

I wanted to restrict access to account, Touch ID, and date settings on a family Mac while still letting the kids join Wi-Fi at school. Screen Time covered app limits, but I also wanted control over the settings they could open.

I compared hiding panes, using configuration profiles, and writing a System Settings preference with defaults. I chose the preference for pane access and kept NextDNS configuration in a profile. These are separate controls: restricting a settings pane is not a guarantee that the underlying setting cannot be changed another way.

#Before you start: check account types

Use an administrator account for managing the Mac and a Standard account for your child. Administrator access would let them undo the restrictions you apply.

Check the accounts:

1. Open System Settings > Users & Groups.
2. Make sure your account is set to Admin.
3. Make sure their account is set to Standard.

#Hiding panes

Older versions of System Preferences had a View > Customize option for hiding panes. That only changed which panes were shown, and the user could enable them again. It wasn't an access restriction, and it isn't the setup I wanted.

#Configuration profiles

Configuration profiles are another way to manage settings. They are also how I configure NextDNS on the Mac.

The settings a profile enforces and whether a user can remove it depend on the payload and how the profile is installed.

For a few pane restrictions, I found the preference easier to manage than maintaining another profile. I kept the profile approach for NextDNS.

#Restricting panes with defaults

The defaults command below writes the DisabledSystemSettings key in /Library/Preferences/com.apple.systempreferences. It is a machine-level preference, so it can affect your administrator account too. Pane identifiers and behaviour can vary by macOS version; check the result from the Standard account.

#Keeping Wi-Fi available

I wanted to leave network access available while managing the NextDNS configuration separately. Restricting the Network pane would get in the way of joining new networks.

The pane selection reflects that:

1. Leave the Network pane open (Wi-Fi still works).
2. Restrict the Profiles pane, with profile removal permissions checked separately.
3. Restrict the account and security panes.

#Step 1: Install and check the NextDNS profile

Open the NextDNS .mobileconfig file from the administrator account, then review and install it in System Settings. Apple's configuration-profile instructions describe the process; the pane may be labelled Profiles or Device Management depending on the macOS version.

The old sudo profiles -I -F command cannot install configuration profiles on macOS 11 or later. The local man profiles documentation explicitly directs you to System Settings instead.

Before restricting access to the pane, check that the profile applies to the intended account and that the Standard user cannot remove it. Hiding access to the pane is not a substitute for those checks.

#Step 2: Restrict the settings panes

Before changing it, record any existing value with sudo defaults read /Library/Preferences/com.apple.systempreferences DisabledSystemSettings. The following command replaces the array. com.apple.Network-Settings.extension is intentionally absent from the list.

sudo defaults write /Library/Preferences/com.apple.systempreferences DisabledSystemSettings -array "com.apple.Touch-ID-Settings.extension" "com.apple.Date-Time-Settings.extension" "com.apple.Users-Groups-Settings.extension" "com.apple.Profiles-Settings.extension"

#Step 3: Restart System Settings

Close System Settings so it reloads the preference when opened again:

sudo killall "System Settings"

#Check the result

Reopen System Settings from the Standard account and check the four restricted areas: Touch ID & Password, Date & Time, Users & Groups, and Profiles or Device Management. Confirm that joining a new Wi-Fi network still works and that NextDNS remains configured.

These commands restrict access through System Settings. Don't infer that they prevent every password-change method, all DNS changes, or all ways of bypassing Screen Time. If you need stronger enforcement, use supported management profiles for the settings concerned.

#Restore access

If the key did not exist before this change, remove it to restore access:

sudo defaults delete /Library/Preferences/com.apple.systempreferences DisabledSystemSettings

Reopen System Settings after removing the key and check that the panes are available again. If the key already contained restrictions before you started, restore that earlier value rather than deleting it.