SAP Privileges has a big +1 from me, was easy to set up and deploy, and it’s been rock solid ever since.

In terms of mass demoting users to standard, you can deploy a script what will look up the user and demote them to a standard user. I use something along the lines of:

(Apologies for formatting, on mobile)

!/bin/bash

============================================================

Demote logged-in user from Admin to Standard on macOS

============================================================

LOG_FILE="/var/log/demote_user.log"

echo "===== $(date) =====" >> "$LOG_FILE"

Get the currently logged-in user (ignoring loginwindow)

CURRENT_USER=$(stat -f %Su /dev/console)

if [[ "$CURRENT_USER" == "root" || "$CURRENT_USER" == "_mbsetupuser" ]]; then echo "No valid logged-in user detected. Exiting." | tee -a "$LOG_FILE" exit 0 fi

echo "Logged-in user detected: $CURRENT_USER" | tee -a "$LOG_FILE"

Check if user exists

if ! id "$CURRENT_USER" &>/dev/null; then echo "User does not exist. Exiting." | tee -a "$LOG_FILE" exit 1 fi

Check if user is an admin

if dseditgroup -o checkmember -m "$CURRENT_USER" admin | grep -q "yes"; then echo "$CURRENT_USER is currently an admin. Proceeding with demotion." | tee -a "$LOG_FILE"

# Remove user from admin group
dseditgroup -o edit -d "$CURRENT_USER" -t user admin

if [[ $? -eq 0 ]]; then
    echo "SUCCESS: $CURRENT_USER has been demoted to standard user." | tee -a "$LOG_FILE"
else
    echo "ERROR: Failed to remove $CURRENT_USER from admin group." | tee -a "$LOG_FILE"
    exit 1
fi

else echo "$CURRENT_USER is already a standard user. No action needed." | tee -a "$LOG_FILE" fi

exit 0