Setting up a Mac for young children | Cyber Security

Latest breaking news on

Over the summer I decided to give my kids an old Apple laptop to share.

We use laptops for school homework from time to time but my kids spend most of their screen time poking and swiping tablets. I wanted to broaden their horizons a little: do a bit of coding; a bit of web searching; get them comfortable with a keyboard; give them something valuable that they had to look after; and get the ball rolling with developing some good computer security habits.

The kids have been at school for a few years and they’re are old enough to have a little independence, but most of what they do is supervised or subject to fairly restrictive boundaries.

The would be no exception, there would be boundaries, so I enlisted its in-built parental controls to see what they could do, and how they could help.

This article walks you through the things I did to secure the laptop, and details the parental controls and options I chose. Later this week we’ll walk you through a similar setup for a Windows machine so stay tuned for that.

A clean slate

Because I was reusing an old laptop I decided to wipe it clean and start again. I reinstalled macOS over the internet on to an encrypted filesystem, went through the setup process until I had a working computer with one user account and installed Sophos Home.

I do this whenever a computer changes hands, even in the same household, but it’s not a prerequisite for up parental controls. I’m just letting you know what state my laptop was in when I wrote these steps.

All you need is a working Mac that you’re happy for your kids to spend some time on. What is important is that each of your starts with their own clean slate: a user account that’s theirs and nobody else’s.

Users

As our starting point I will assume you have a working Mac on which you have Admin rights.

Log on to your Mac and go to System Preferences > Users & Groups. On the left hand side is a list of users. Under your name it should say Admin.

Users & Groups

Before setting up parental controls we need to create an account for each child. To add an account, click on the + button.

When the new user dialog opens choose Managed with Parental Controls from the drop down and fill in the rest of your child’s details. I suggest you enter a placeholder password at this point – you can help your child to change it later.

Mac new user dialog

When you click Create user you’ll see that your child has been added to the list of users on the left, and that Enable parental controls is ticked.

Users & Groups

Highlight the child’s name in the left hand menu and click the Open Parental Controls… button.

Parental controls

Different families will require different settings so I’m going to take you through the very restrictive set that I used, as an example, but your mileage may vary.

Whatever your choices, I suggest you apply the principle of least privilege, giving your children the access they need, and no more. If I couldn’t immediately think of a sensible use case for allowing something, I switched it off. It’s easy to change the settings if later if you get something wrong.

As you go through the controls, pay careful attention to the labels because you’ll be using ticks to indicate both positives and negatives – sometimes your tick means allow, at other times it might be disable or restrict.

There are six tabs in the parental controls pane: Apps, Web, Stores, Time, Privacy and Other.

Apps

The Apps tab lets you limit access to the computer’s camera, set restrictions on email and multiplayer games, and create an allow list of apps.

I couldn’t think of a reason my children would need the camera or multiplayer games so I unticked Allow use of camera and Allow joining Game Center multiplayer games.

Apps

To restrict who can exchange emails with your child tick Limit Mail to allowed contacts and click the Manage… button.

I ticked Send requests to and entered my email address so that I’ll be notified of any attempts to email sombody who isn’t on the allow list.

Click the + button and add the names and email addresses of the contacts you’ll allow.

Manage Allowed Contacts

Click Done to return to the Apps tab.

Next, tick Limit Applications on this Mac. Click the arrows to list the apps on your computer. Again, I suggest you take the attitude that everything is off limits unless you have a reason for it not to be.

Allowed Apps

In my screenshot you’ll see that Safari is ticked, giving the child access to the entire web, warts and all. I used the controls in the next tab, Web, to rein that in.

Web

To put some boundaries on my child’s web access I clicked on the Web tab and selected Allow access to only these websites. To add a website to the list click the + button.

Web

If you want to give your kids more freedom then the second option, Try to limit access to adult websites, might be worth a try. Note that Apple is very clear that it’s trying to limit access with this tool. No filter is foolproof so if you choose this option, understand that undesirable sites may get through the filter, and some legitimate sites might not.

If you enable that option you can also use the Customize… button to open a dialog where you can set your own block and allow lists to supplement Apple’s adult website filtering.

Stores

Under the Stores tab you can set up controls for accessing TV shows, books and movies, as well as Apple’s online stores. I ticked options to disable iTunes Store, iTunes U and the iBooks Store.

I also ticked to restrict Music with explicit content, and then ticked Movies to:TV shows to: and Apps to:, and choose age-appropriate values from their drop downs. Finally, I ticked to restrict Books with explicit sexual content. I couldn’t imagine a situation where that would actually be necessary but the principle of least privilege applies – the child doesn’t need it, so they don’t get it.

Stores

Time

The controls under the Time tab allow you to specify how long your child can use the laptop for, and at what times of day. I chose to limit time to one hour per day at times of day when they’re normally awake.

To cap the amount of time to one hour per day, tick Limit weekday use to and Limit weekend use to, and set the sliders to 1 hour a day.

To prevent access over night I ticked School nights and Weekend, and set the times to 20:00 and the finish times to 07:30.

Time

Privacy

The Privacy tab limits access to your kids’ data. Under Allow changes to you’ll see a list of items that can be changed by apps on the computer. For example: ticking Contacts allows apps to create new contacts in the address book and unticking it stops that.

I couldn’t think of a good reason to allow Twitter and Facebook so they’re unticked.

Privacy

The Manage Privacy… button at the top allows you to see which apps have access to which services on the Mac, and to decide if you’re prepared to allow it. So, if you want Siri and Maps to have access to Location Services, you can set it here.

Either because my Mac was pretty bare, or because of the options I selected when setting up the Mac (such as disabling Siri entirely), there was nothing for me to untick here.

Note that clicking Manage Privacy… kicks you out of the Parental Controls pane and opens up the Privacy tab of the Security & Privacy pane. When you’re done just click the back button to return to the Privacy tab under Parental Controls where you started.

Security & Privacy

Other

The last tab in the row is Other, and it’s where Apple has swept all the things that don’t fit anywhere else under one rug. Note that the first five options are negative and the last, Use Simple Finder, is positive.

I elected to untick Prevent the Dock from being modified, so my child could customise the appearance to their liking (see the passwords section below for more on that), and I elected to Use Simple Finder, because computers are baffling enough when everything is new.

Other

Remote setup

Hidden away where you’ll never, ever find it is an option to enable remote control of a computer’s parental controls. This feature allows you to modify the parental controls on your child’s computer from another Mac on the same network.

To enable it, click on the settings icon (the cog) under the list of children’s names on the left of the Parental Controls pane, and click Allow Remote Setup.

Remote Setup

If you log into a different Mac on the same network and go to System Preferences > Parental Controls you’ll see the name of your child’s computer. If you click on it you’ll be asked for the username and password of a user with Admin rights on that computer. Once you’ve logged in you’ll be able to select your child’s name and modify their parental controls as if you were sat at their computer.