Skip to main content
Jamf Nation, hosted by Jamf, is a knowledgeable community of Apple-focused admins and Jamf users. Join us in person at the ninth annual Jamf Nation User Conference (JNUC) this November for three days of learning, laughter and IT love.

Allow non admins to change Network preferences.

I have a script that has been working for 10.6 that unlocks Network for non admins, but it doesn't seem to work with 10.7. Anyone have any ideas what it takes to make it work in 10.7? Below is my current script I am using for this.



$plbud = "/usr/libexec/PlistBuddy";
$auth = "/private/etc/authorization";

$sysprefso = `$plbud -c \"print :rights:system.preferences:session-owner\" $auth`;
if ($sysprefso !~ /true/) {
print"Needs authorization file modified\n";
# Set system.preferences settings here
system"$plbud -c \"add :rights:system.preferences:session-owner bool true\" $auth";
system"$plbud -c \"set :rights:system.preferences:session-owner true\" $auth";
system"$plbud -c \"set :rights:system.preferences:allow-root true\" $auth";
system"$plbud -c \"set :rights:system.preferences:comment Authenticate either as the owner or as an administrator.\" $auth";
print"Modified authorization file to allow non-admins to modify network settings\n";
else {
print"authorization file already modified\n";
Like Comment
Order by:
SOLVED Posted: by mattsmacblog

10.7's authorization file has much more granular control.

The keys that need changing in /etc/authorization are




Your script probably still works for the top key, but you'll need to extend it to unlock the second.

I wrote some info up here \-

It's not at the scripting level and I haven't gone into <key> vs <group> based unlocking. You can change <key></key> from the <user> class to <rule> to apply the session-owner rule if you want.


SOLVED Posted: by abenedict

Thanks! Here is what I came up with for editing my authorization file.
I add the .plist to the file when copying because I have a couple of defaults write commands that run on the file as well.

#Copy file to tmp location
/bin/cp -pr /etc/authorization /private/tmp/authorization.plist
# Unlock System Preferences for non admins.
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences:group staff' /private/tmp/authorization.plist
# Unlock Network Settings preference pane
/usr/libexec/PlistBuddy -c 'Set staff' /private/tmp/authorization.plist
# Unlock Printer Preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.printing:group staff' /private/tmp/authorization.plist
# Unlock time machine preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.timemachine:group staff' /private/tmp/authorization.plist
# Unlock energy saver preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.energysaver:group staff' /private/tmp/authorization.plist
# Move file back to original location   
/bin/mv /private/tmp/authorization.plist /etc/authorization
SOLVED Posted: by quedayone

Thanks for this!

SOLVED Posted: by jsimmons

Imm newbie can you tell me where to put this script to get it to work.

Thank you

SOLVED Posted: by Matt

Login script would work.

SOLVED Posted: by jamf.admin

Will this still work in 10.8 or has the authorization file changed?

SOLVED Posted: by Chris

It's pretty much the same, although i found that for unlocking network prefs in ML you have to modify the

in addition to what's mentioned above.


/usr/libexec/PlistBuddy -c 'Set allow' /etc/authorization