Is there a such thing as Old People IT services?

December 21, 2012 2:09 PM

After a decade of virus-filled PCs, a few years ago I got my dad a iMac. After a conversion period, he was off and running and doing fine. But he still finds amazing ways to do things like delete all his applications and otherwise ruin the thing. Is there any sort of lightweight IT service I can pay to lock down his Mac a little and prevent him from messing it up?

I know big MacOS using corporations have smart IT staffs that can lock down their installations so employees can't screw up their Macs too badly. I kind of need that for my dad, he is constantly somehow tossing his entire applications directory into the trash and deleting it. As a result, he no longer has say, iChat so I can't remotely control his computer to fix things.

I'm thinking:

- slightly locked down MacOS that doesn't let you destroy your own system
- Under $30/month
- minimal support for questions if I can't help him remotely

Does such a thing exist?

(I've also given him an iPad and a Google Chromebook in the past to try and get him something with just a web browser in it, since that's what he mostly does on a computer: surf the web, but those both fall short for some reason)

posted by mathowie to Computers & Internet (18 answers total)

Have you tried taking away his admin access on the mac and perhaps even utilizing Parental Controls? That should prevent him from doing drastic things like deleting everything, and you can even control the way the desktop looks and what applications and folders he has access to with the parental controls. You don't have to use the other features that one would normally use (timing applications, blocking certain websites, etc.), and you can still remote in to upgrade the computer or download new programs if he wants them.
posted by two lights above the sea at 2:16 PM on December 21, 2012

Just do what I do:

- Set up the Mac with two accounts: An admin account for you and a Standard (non-admin) account for him. Because he won't have the admin password, he can't do things like delete applications. It also can help prevent him from installing the small-but-growing malware scourge coming at the Mac ecosystem.
- install TeamViewer or LogMeIn. This way you can remotely get to his computer and drive it. This is how you can keep it up to date.

If you're looking for something more advanced, you might look at Faronics DeepFreeze, which will definitely allow you to lock down the machine more tightly than a non-Admin account.
posted by mrbarrett.com at 2:17 PM on December 21, 2012

Agreed. That was going to be my suggestion as well. OSX makes it easy to do.
posted by Taken Outtacontext at 2:19 PM on December 21, 2012

(You can set it up so the parental controls are managed on another computer, too!)
posted by two lights above the sea at 2:21 PM on December 21, 2012

You might want to look into enabling (ironically named) Parental Controls on his machine. Along with not giving him admin rights on his account (create a second account that you use to log in with), it lets you limit what applications he can run, and do additional fine grained controls.

Along with that, I would set him up with CrashPlan to make sure it backs up everything on his machine to a machine in your house (so he can't erase a backup drive) and their online service. He might not be able to do a recovery with it, but you will know that it is backing up his system and so you can recover files for him.

Install logmein or similar apps.
posted by mrzarquon at 2:23 PM on December 21, 2012

If you end up wanting to go with a fix that's a smaller in scope, you can always make the Applications folder (and any other important folder) hidden, the way the System folder is hidden.

You'll also want to remove it from the Sidebar.
posted by ignignokt at 2:24 PM on December 21, 2012

Make sure you set up time machine (with or without time capsule) to make restores easier. Worst case scenario, you can do a complete system restore pretty painlessly.
posted by empath at 2:26 PM on December 21, 2012

The admin and standard accounts is the way I have approached this problem on PCs, Macs and even Ubuntu machines both in work and friends and family environments now for more than a decade.

I just tell them to use the admin account only for updating, installs and the like and the user account for everything else.

Although I have had a few folks abuse the admin account their reward is a toasted machine and an unwillingness on my part to fix it ... again.
posted by bz at 3:14 PM on December 21, 2012

"If you end up wanting to go with a fix that's a smaller in scope, you can always make the Applications folder (and any other important folder) hidden, the way the System folder is hidden."

Don't do this - it can cause problems with some apps (e.g. IIRC Word will spit, anything that modifies its own app bundle will break, etc), many installers will simply not work, and is a totally unsupported and non-standard solution that is more trouble than it's worth. Why create problems like that when the simplest, correct, and working way, as every else has pointed out, is to use separate admin and user accounts?

"You'll also want to remove it from the Sidebar."

This, though, is a fair idea.
posted by Pinback at 3:36 PM on December 21, 2012

Take one trip to set it up. Make yourself the admin and set up parental controls. In particular

- lock the dock to keep him from removing apps from it
- Set up Firefox in lockdown mode or Chrome in lockdown or nanny mode so he can't lose parts of them
- set ichat up with a you-only account and set it to log in when he turns the computer on
- same with Skype so you have a backup option
- time machine so you can roll anything back
- set software update to happen automagically in the background

Then if he screws anything up the worst case is "turn it off and on again" and he'll be logged in to ichat and Skype (assuming his internet works) and you can get control of his machine and see what might have happened.
posted by jessamyn at 3:51 PM on December 21, 2012

Nthing setting up and admin account and a non-admin account for everyday use. That's what I do for myself. You don't have to keep the admin account secret from him - that will keep him from being able to install or update apps. But when the authentication screen comes up - it's a good reminder that you are doing something important. It is also a help against trojan horses as long as he doesn't just blindly authenticate when the dialog comes up.
posted by nightwood at 4:18 PM on December 21, 2012

Also, I work for a very large MacOS using corporation and our IT department does nothing in the way of locking down our Macs.
posted by nightwood at 4:20 PM on December 21, 2012

Seconding Deep Freeze. My IT department manages our lab Macs - a fleet of about 80 - with this app.
posted by porn in the woods at 6:16 PM on December 21, 2012

FWIW, most schools use either Casper Suite or Apple's own server product, Workgroup Manager to lock down Macs (both are massive overkill for your situation). In our area at least, I don't know anybody who uses Deep Freeze. Then again, we also don't let kids log in as admins, which virtually eliminates the need for actually locking down the laptops.

Point is, setting up a non-admin account should fix most your issues without requiring further configurations. Except people dragging Applications to the desktop and then trying to run from there. Egads.

For remote support, I find LogMeIn the easiest as it requires no input from the end computer once you've set it up.
posted by jmd82 at 8:07 PM on December 21, 2012

Time Machine is a good suggestion, and is built into the OS (just requires an external drive that's at least as big as the internal one). It's good because if you navigate to an area where a file SHOULD be, you can instantaneously start diving 'back in time' until you find the it and can bring it back (this also works for files that were modified instead of deleted). Of course, you can also use the search bar in TM if you don't know where or when it existed.

One thing that I'd like to add is that you should set the TM drive as invisible - this doesn't affect the backup or restore process at all; it just makes it so that pesky humans can't see it (or click on it, or delete it, etc).
posted by destructive cactus at 10:53 PM on December 21, 2012

Umpteenthing the Admin v. Standard account set-up. As long as you don't give him the Admin credentials, he won't be able to do anything deadly to the iMac.
posted by Thorzdad at 5:56 AM on December 22, 2012

2nding Time Machine. I use it without a Time Capsule. I just have it on an external hard drive.
posted by 2oh1 at 11:29 AM on December 22, 2012

We just set up our second OSX workstation for students at my workplace, and we're considering the idea of managing them via puppet. Assuming you can set it up to where he can't screw that up, it might be able to restore various tidbits should they go awry.
posted by pwnguin at 12:42 PM on December 22, 2012