Expiration & Timing
▼
Expiration Interval Privileges 2.0+
Set a fixed time interval after which administrator privileges expire and revert to standard user rights. A value of 0 disables the timeout and allows the user to request permanent administrator privileges.
Privilege Renewal
▼
Allow Privilege Renewal Privileges 2.1+
Specifies whether expiring administrator privileges can be renewed. When enabled, the user will receive a notification one minute before administrator privileges expire. The notification includes a Renew button that can be used to renew administrator privileges.
Disabled
Renewal Follows Auth Setting Privileges 2.1+
When enabled, renewing privileges requires the same kind of authentication as initially requesting administrator privileges.
Disabled
Renewal Notification Interval Privileges 2.4.1+
Specifies the number of minutes before the expiration of administrator privileges when Privileges should notify users to renew their privileges. This number must be lower than the expiration interval, otherwise it defaults to 1. If a
RenewalCustomAction is specified, its ActionNotificationInterval overwrites the configured interval.
Renewal Custom Action Privileges 2.3+
Specifies a custom action to notify the user about expiring administrator privileges. So you can inform your users using a dialog or whatever you want.
If configured, the default renewal notifications are disabled and the specified executable is launched instead.
If set, the PrivilegesAgent calculates the SHA-256 checksum of the binary specified using the
ActionExecutablePath option. If the calculated checksum matches the specified one, the binary is executed. Otherwise, the launch operation fails silently, logging only the checksum mismatch.
This optional value can be configured to specify how many minutes before the admin privileges expire the executable should be launched. If not configured, or the configured value is smaller than 1 or bigger than the expiration interval - 1, it defaults to 1 minute. The notification interval is also passed to the executable configured using
ActionExecutablePath as the $1 argument.
Auto Renewal Process Paths Privileges 2.6+
Specifies the paths to applications/binaries that trigger an automatic renewal of a user's administrator privileges while they are running. At the specified
RenewalNotificationInterval, the PrivilegesAgent checks to see if the user has one of the specified processes running. If so, the administrator privileges are renewed automatically. This feature works independently from the AllowPrivilegeRenewal setting. Therefore, even if you disable privilege renewals for your users, you can still use the automatic renewal feature.
Authentication
▼
Require Authentication Privileges 1.5+
Specifies whether authentication is required to obtain administrator privileges. When enabled, the user is prompted for the account password (or Touch ID, if available).
Disabled
Enable Smart Card Support Privileges 2.2+
Specifies whether to enable smart card support for authentication. Since the modern Local Authentication framework does not yet support smart cards/PIV tokens, enabling this option will cause the application to fall back to the older Authorization Services. Enabling this option will disable
RequireBiometricAuthentication.
PrivilegesCLI does not use smart card authentication by default. To enable it, please make sure the AllowCLIBiometricAuthentication setting is also enabled.
Disabled
Require Biometric Authentication Privileges 2.4+
Specifies whether biometric authentication is required to obtain administrator privileges. When enabled, the PrivilegesAgent prompts the user for Touch ID and does not offer an alternative option. If Touch ID is unavailable or has not been configured, the user is prompted for their account password instead.
Disabled
Biometrics Fallback Type Privileges 2.4.2+
This specifies the fallback strategy when
RequireBiometricAuthentication is enabled. By default, users are prompted to enter their username and password if biometric authentication is not configured or is unavailable. However, this may not be the desired behavior in all environments.
PrivilegesCLI does not use biometric authentication by default. Therefore, this setting will be ignored unless the AllowCLIBiometricAuthentication setting is enabled.
Allow CLI Biometric Authentication Privileges 2.0+
Specifies whether to allow biometric authentication (or smart cards) in the PrivilegesCLI to obtain administrator privileges. When enabled, the authentication process is passed to PrivilegesAgent, which then prompts the user for Touch ID or smart card. If neither of these are available, the user is prompted for the account password.
Disabled
Access Restriction
▼
Limit to User Privileges 1.5+
Restricts use of the application to the specified user or list of users. When used with a client management system that supports variables in configuration profiles, variables such as
$USERNAME can be used here.
Limit to Group Privileges 1.5+
Restricts use of the application to the specified group or list of groups.
Automatic Revocation
▼
Revoke Privileges at Login Privileges 2.0+
When enabled, the user's administrator privileges are revoked at login.
For those who use fixed admin accounts on their machines: If you want to enable this feature, please make sure you exclude the admin account(s) using the
RevokeAtLoginExcludedUsers key. Otherwise these accounts become standard user accounts at next log in.
Disabled
Revoke at Login — Excluded Users Privileges 2.1+
If
RevokePrivilegesAtLogin is enabled, the specified users are excluded from privilege revocation at login. When used with a client management system that supports variables in configuration profiles, variables such as $USERNAME can be used here.
Revoke Privileges after System Time Change Privileges 2.4.1+
When enabled, the user's administrator privileges are revoked if the system time did change. Enable this feature to prevent users from extending their admin time by adjusting the time on their Mac.
Disabled
Revoke after Time Change — Excluded Users Privileges 2.5.2+
If
RevokePrivilegesAfterSystemTimeChange is enabled, the specified users are excluded from privilege revocation after system time did change. When used with a client management system that supports variables in configuration profiles, variables such as $USERNAME can be used here.
Revoke Privileges on Screen Lock Privileges 2.5.1+
When enabled, the user's administrator privileges are revoked whenever the screen is locked.
Disabled
Revoke on Screen Lock — Excluded Users Privileges 2.5.2+
If
RevokePrivilegesOnScreenLock is enabled, the specified users are excluded from privilege revocation on screen lock. When used with a client management system that supports variables in configuration profiles, variables such as $USERNAME can be used here.
Automatic Revocation — Excluded Users Privileges 2.5.2+
The specified users are excluded from any automatic revocation. This key is evaluated before the keys
RevokeAtLoginExcludedUsers, RevokeAfterTimeChangeExcludedUsers, RevokeOnScreenLockExcludedUsers, and any other automatic revocation key that may be introduced in the future. If a user is listed in the AutomaticRevocationExcludedUsers key, the other keys are not evaluated. When used with a client management system that supports variables in configuration profiles, variables such as $USERNAME can be used here.
Reason
▼
Reason Required Privileges 1.5+
When enabled, the user must provide a reason for requesting administrator privileges. The reason is logged. Note that once this option is enabled, privileges cannot be changed from the Privileges Dock tile menu or the status item menu.
Disabled
Minimum Length Privileges 1.5+
If
ReasonRequired is enabled, this key specifies the minimum number of characters the user has to enter as the reason for becoming an admin. If not set, the value defaults to 10. If a value < 1 is specified or if ReasonMinLength is > 250, the value is set to default.
Maximum Length Privileges 1.5.3+
If
ReasonRequired is enabled, this key specifies the maximum number of characters the user can enter as the reason for becoming an admin. If not set, the value defaults to 250. If a value > 250 is specified or if ReasonMaxLength is <= ReasonMinLength, the value is set to default.
Reason Checking Privileges 2.0+
When enabled, the text the user enters for a reason is roughly parsed for valid words. If the text does not contain any valid words, the Request Privileges button remains grayed out, even if the minimum number of characters has been entered. The test passes if the text contains any valid words, even if they don't make sense.
This feature is experimental and disabled by default. If you enable it, please check carefully that it works as expected in your environment.
Disabled
Pass Reason to Executable Privileges 2.1+
Specifies whether the reason that the user entered when requesting administrator privileges should be passed to the executable configured with the
PostChangeExecutablePath key. This is disabled by default. If enabled, the reason is passed to the executable as $3.
Disabled
Reason Preset List Privileges 1.5.3+
This key allows to pre-define a list of possible reasons (for becoming an admin) the user can choose from. When set, an additional pop-up menu will appear in the dialog box. This only works for the GUI version of Privileges.
Use Strict Preset List Privileges 2.5.3+
When enabled, the
ReasonPresetList is used as defined, otherwise an additional entry Other… is added to the list of presets allowing the users to enter a custom reason for requesting admin rights.
Disabled
Post-Change Actions
▼
Post-Change Executable Path Privileges 2.0+
When set, the PrivilegesAgent executes the given application or script and provides the current user's user name (
$1) and its privileges (admin or user, $2) as launch arguments. If the application or script does not exist or is not executable, the launch operation fails silently. If you leave the path empty, the pop-up button in the Privileges settings will be locked, preventing the user from configuring a post-change action.
Post-Change Executable Checksum Privileges 2.5.3+
If set, the PrivilegesAgent calculates the SHA-256 checksum of the binary specified using the
PostChangeExecutablePath option. If the calculated checksum matches the specified one, the binary is executed. Otherwise, the launch operation fails silently, logging only the checksum mismatch.
Post-Change Action on Grant Only Privileges 2.0+
When enabled, the application or script, specified in
PostChangeExecutablePath, will only be executed if administrator privileges are granted to a user, but not the privileges are revoked.
Disabled
User Interface
▼
Hide Other Windows Privileges 2.0+
By default, Privileges hides open windows to show the desktop and ensure that only the Privileges window is visible on the screen. Set
HideOtherWindows to false to disable this function.
Enabled
Hide Settings Button Privileges 2.0+
When enabled, the Settings button is no longer displayed in the app.
Disabled
Hide Settings from Dock Menu Privileges 2.0+
When enabled, the Settings menu item is no longer displayed in the Dock tile's menu.
Disabled
Hide Settings from Status Item Privileges 2.1+
When enabled, the Settings menu item is no longer displayed in the status item's menu.
Disabled
Hide Help Button Privileges 2.1+
When enabled, the Help (?) button is no longer displayed in the app.
Disabled
Help Button Custom URL Privileges 2.1+
If specified, this url is called instead of the Privileges GitHub url if the user clicks the help button. Malformed urls and non-http(s) urls are ignored.
Show in Menu Bar Privileges 2.1+
When enabled, a Privileges status item is displayed in the Menu Bar.
Disabled
Show Remaining Time in Menu Bar Privileges 2.4.1+
When enabled, a timer displaying the remaining admin time is shown in the Privileges status item.
Disabled
Usage Policy
▼
Usage Policy Privileges 2.6+
If specified, a usage policy will be displayed the first time the user requests administrator privileges. The user must acknowledge it before proceeding. The PrivilegesCLI command-line tool cannot be used to request administrator privileges until the Privileges application has been launched and the usage policy has been accepted.
No file selected. Accepts .txt or .rtf.
System Integration
▼
Force Update Preboot Volume Privileges 2.4.1+
When enabled, the PrivilegesDaemon runs the command
/usr/sbin/diskutil apfs updatePreboot / whenever a user's privileges change. You should normally never have to enable this function because the preboot volume is updated automatically after a while. However, we implemented this feature because it seems to be needed in some environments.
Please only enable this function if you know precisely why you are doing so.
Disabled
Enable System Extension Privileges 2.5+
Enables the Privileges system extension. The system extension protects the Privileges application and its components against unauthorized modifications, deactivation, or uninstallation. Once this key has been set, it is no longer possible to enable or disable the extension using PrivilegesCLI.
The Privileges system extension requires macOS 13 or newer. Please make sure you grant the extension (corp.sap.privileges.extension) full disk access, otherwise it will not work.
Disabled
Remote Logging
▼
Remote Logging Privileges 1.5+
Configures remote logging settings for the Privileges application.
Please provide an ip address or a fully-qualified domain name (FQDN).