Mac Remote Desktop User Permissions Guide

for a team sharing a rental, request a Figment M-series Mac from $95/month and apply the permission matrix below before you hand out credentials. If you need two isolated Macs with CI runners, backups, monitoring and one hour of monthly support, the Managed Mac Team plan at $999/month covers two M-series Macs and two CI runners. Exact chip, RAM and disk are confirmed in the quote.

A shared Mac rental with poorly scoped permissions is an incident waiting to happen. One remote user who can run sudo or browse another user's home folder can read secrets, change system settings, or disrupt every other session on the machine. This guide maps macOS account types to remote-access capabilities, shows how to remove escalation paths, and gives you a checklist to verify limits before handing over credentials.

macOS account types and what each can do remotely

macOS offers three account types through System Settings › Users & Groups, documented in Apple's users, guests, and groups guide. Understanding what each type can do remotely is the foundation of a safe multi-user rental.

Administrator. Full local control. Admins can install software for all users, change global System Settings, modify other accounts, and run sudo. An admin who connects over VNC has the same power as someone sitting at the keyboard. Never grant admin access to a remote user unless that is explicitly their role.

Standard. The correct baseline for most remote users. Apple states standard users "can install apps and change their own settings, but can't add other users or change other users' settings." They can control their own GUI session over Screen Sharing. They cannot run sudo, install system extensions, or read another user's home folder.

Sharing Only. A common source of confusion. Apple describes these as users who "can access shared files remotely, but can't log in to the computer or change settings." They cannot be used for VNC desktop control. If someone is listed as a Sharing Only user and you expected them to have remote desktop access, they won't. Use a Standard account for VNC and then apply the restrictions below. Screen Sharing use from the connecting side is covered in Apple's share the screen of another Mac article; turning the service on is done in System Settings › General › Sharing.

Permissions matrix: 10 common remote tasks

¹ Even admins need explicit permission or root to traverse another user's home folder; file ownership and POSIX mode 700 on /Users/<name> enforce this by default.

Removing admin escalation paths

If a user was created as an administrator by mistake, or if you want to demote an existing account, remove them from the admin group:

# Confirm current group membership
dseditgroup -o checkmember -m username admin

# Remove from the admin group
sudo dseditgroup -o delete -m username admin

# Verify the change
dseditgroup -o checkmember -m username admin
# Expected: username is NOT a member of admin

After this change, running sudo as that user will fail. You do not need to edit /etc/sudoers manually; admin group membership is what grants sudo on macOS.

One escalation path survives group removal: if the user knows an admin password (because credentials were shared), they can still authenticate sudo by typing that password. Keep admin and user credentials distinct from day one, and never paste an admin password into a session you are observing over VNC.

Restricting software installs with Screen Time

Standard users can install apps from the App Store without entering an admin password. If you want to prevent that, for example to keep a shared rental's software environment stable, use Screen Time (which replaced Parental Controls in modern macOS):

1. Sign in as an admin and open System Settings › Screen Time.
2. Select the target account from the sidebar.
3. Open Content & Privacy and turn it on.
4. Under Store Restrictions, set installing apps and in-app purchases to Don't Allow as appropriate.
5. Under App Restrictions, hide any built-in apps the user should not see.

Screen Time can also block specific websites, limit app usage, and prevent changes to passcode and account settings. The restricted user cannot modify these without the Screen Time passcode you set.

Screen Sharing access control: who can VNC in

Turning Screen Sharing on in System Settings › General › Sharing does not automatically let every account connect. Set access to Only these users and add accounts explicitly. Under the hood, this maps to membership of the com.apple.access_screensharing group:

# Add a user to the Screen Sharing allow-list
sudo dseditgroup -o edit -n /Local/Default \
    -a username -t user com.apple.access_screensharing

# Remove a user from Screen Sharing access
sudo dseditgroup -o delete -m username \
    -t user com.apple.access_screensharing

# List current Screen Sharing members
dscl . -read /Groups/com.apple.access_screensharing GroupMembership

The per-account macOS password is used for Screen Sharing. If you also enable the legacy VNC viewer password in Computer Settings, treat it as a shared secret: give it a unique value per engagement and rotate or disable it when the engagement ends.

Audit checklist: verify limits before handing over access

Log in as the restricted user over VNC, or ask the user to run these and share the output. Each test is designed so the expected outcome is a denial:

# 1. Confirm not in admin group — should print that whoami is NOT a member
dseditgroup -o checkmember -m "$(whoami)" admin

# 2. Confirm non-interactive sudo is blocked
sudo -n true 2>&1 || echo "sudo blocked (expected)"

# 3. Confirm home-folder isolation against another local user
other=$(dscl . -list /Users | grep -vE '^(_|daemon|nobody|root|'"$(whoami)"')$' | head -1)
ls "/Users/$other" 2>&1 || echo "access denied for $other (expected)"

# 4. Confirm cannot change global network settings
networksetup -setdnsservers Wi-Fi 1.1.1.1 2>&1 \
    | grep -Eqi 'administrator|not authorized|error' \
    && echo "network change blocked (expected)" \
    || echo "check manually in System Settings › Network"

If any test returns unexpected success, review the account's group membership and Screen Time configuration before the user starts work. Apple's macOS Security overview is a useful cross-reference for the identity, FileVault, and system-integrity layers that back these checks.

Revoking access cleanly

When the engagement ends, disable the account first and remove data only after you have captured anything needed for audit:

# 1. Disable the account (immediate; preserves files)
sudo dscl . -create /Users/username \
    AuthenticationAuthority ";DisabledUser;"

# 2. Remove from the Screen Sharing allow-list
sudo dseditgroup -o delete -m username \
    -t user com.apple.access_screensharing

# 3. Rotate the legacy VNC viewer password if you enabled one, and
#    check for any live session
who

# 4. When you are ready to delete the data
sudo sysadminctl -deleteUser username

sysadminctl -deleteUser removes the home directory by default; add -keepHome if you want to retain it for archival.

Picking the right Figment plan for this workflow

For teams cycling contractors or short-term users, a Figment M-series Mac from $95/month gives you a dedicated environment you can reprovision between engagements; exact chip, RAM and disk are confirmed in the quote. The Managed Mac Team plan at $999/month includes two M-series Macs, two CI runners, team setup, backups, monitoring and one hour of monthly support, which helps when two developers need isolated desktops at the same time. The $29 virtual Intel macOS environment is accessed through a browser console rather than VNC, so it is a better fit for scripted admin tasks than for a shared GUI rental. Request a configuration quote or see all Mac hosting plans.

Related: Remote Mac setup for designers · Shared remote desktop for multi-user Mac rentals · Run GitHub Actions self-hosted runners on a Mac