Locking Down macOS Settings (The Real Way)

If you have kids in the Apple ecosystem, you know iOS handles restrictions pretty well. Toggle "Don't Allow Account Changes" or "Don't Allow Passcode Changes" and you're mostly covered.

But then you open their Mac, and those options just aren't there.

Screen Time does a decent job with app limits, but it won't stop a resourceful kid from adding a new fingerprint to Touch ID or nudging the system clock back a few hours to dodge downtime. I went looking for a proper fix and ended up testing three different approaches.

#Contents

1. Before You Start: Check Account Types
2. Option 1: The "Hidden" Menu (Too Weak)
3. Option 2: The "Enterprise" Way (Profiles)
4. Option 3: The "Developer" Way (My Pick)
5. What did we just do?
6. How to Revert

---

#Before you start: check account types

Before touching any config, there's one thing that has to be true: your child must be a Standard user.

If they're an Administrator, they have sudo privileges. And kids are surprisingly good at Googling their way around restrictions once they know something is locked. A standard account removes that whole problem before it starts.

Check this now:

1. Open System Settings > Users & Groups.
2. Make sure your account is set to Admin.
3. Make sure their account is set to Standard.

The easiest approach is just to hide the settings pane.

1. Open System Settings.
2. Go to View > Customize...
3. Uncheck Touch ID & Password.

Not a chance. Any kid who wants to change their password will go straight back to that menu, re-check the box, and carry on. Hiding a setting is not the same as blocking it.

#Option 2: The "Enterprise" Way (Profiles)

You can create a .mobileconfig file (an Apple Configuration Profile) that uses the DisabledSystemSettings payload. This is how schools and businesses manage Macs.

Write an XML file, double-click it to install, and it hard-locks those settings.

This actually works well. The catch is that managing XML files for simple toggles is fiddly if you're not running a full MDM server. I decided to save the profile approach for something that really needed it (NextDNS), and go a different route for the settings locks.

#Option 3: The "Developer" Way (My Pick)

The defaults command can write to the Global Preferences at /Library/Preferences, which affects all users on the machine. Run it from your Admin account and it locks down their Standard account immediately - no profile installation, no reboot required.

It's also much faster to script and toggle than dealing with profiles.

#The Strategy: "The Wi-Fi Gap"

My situation had one wrinkle: they need to be able to join Wi-Fi at school.

Lock the Network pane and they can't connect to new networks. Leave it open and they could switch their DNS and walk straight past my NextDNS content filters. Neither option on its own is great.

The fix is to be selective about what you lock:

1. Leave the Network pane open (Wi-Fi still works).
2. Lock the Profiles pane (they can't remove the NextDNS config).
3. Lock the Security panes (no password or fingerprint changes).

#Step 1: Install NextDNS as System

Install the NextDNS profile via terminal to force it to the System level. A Standard user can't modify or remove a system-level profile.

#Step 2: Lock the Settings

Run this command to lock the specific panes. Note that com.apple.Network-Settings.extension is intentionally absent from the list.

#Step 3: Apply

To pick up the changes without rebooting, kill the settings app:

#What did we just do?

Here's what the end state looks like:

• Wi-Fi / Network is unlocked. They can still join school Wi-Fi without any help from you.
• Touch ID & Passcode is locked. No password changes, no sneaking in a new fingerprint.
• Date & Time is locked. This stops the "set the clock back 3 hours" trick that gets around downtime schedules.
• Users & Groups is locked. They can't create a fresh Standard User account to sidestep Screen Time limits.
• Profiles is locked. This is the one that really matters. The "Remove Profile" button lives here, so NextDNS stays put.

#How to Revert

When you need to add a fingerprint or change a setting yourself, just delete the key.

That's it. A few defaults writes and your Mac is meaningfully more locked down than it was before.