I think you hit the nail-on-the-head, RobG. Any admin user can unlock the screen saver and resume whatever session is active. That is the way it is supposed to work. Every UNIX/X11 desktop I've ever worked with also works the same way.

In order to change users, I suspect that you must click the "Switch User" button on the login window.



[ Reply to This | # ]

True, but the BIG difference here is that as an admin, you can change the password and gain access to the other user' system, and the other user will know about the access, as the password has changed. In the above situation, the admin has access to the other user's system without the other user's knowledge.

---
Live and Direct, only from
Network 23

[ Reply to This | # ]

It is not difficult for an admin to change a user's password to log in to an account, then change it back, without the other using knowing about it. The exception is a filevault protected account, but even they can be accessed if they are already logged in and the session is just suspended.

[ Reply to This | # ]

Why change the password at all? As an admin I can have full access to any file you own.

Also with a single command I can become that user without having to know that user's password. Now since OS X is not X11, I'm not certain I can start a GUI session, but I can do anything else I want.

Remember that an admin(aka root-like) on a UNIX machine can pretty much do anything they want.

[ Reply to This | # ]

Please note, that the above does not apply to a file-vault account since the data there is kept in an encrypted DMG file and cannot be mounted without the right key.

[ Reply to This | # ]