Ubuntu 18.04 gnome settings: how to fix "System policy prevents changes. Contact your system administrator" on 2nd user which is already an admin

Question

I have an Ubuntu 18.04 machine with 2 users. Both are admins. The 1st user works fine. The 2nd user has some system settings greyed out, such as the unlock button for modifying users. When I hover over it it says, "System policy prevents changes. Contact your system administrator":

...and the unlock button for modifying printer settings, as well as the printer settings themselves--both are greyed out!

Same with the Date & Time settings...the Unlock button is greyed out and has the same message.

What's wrong? How can I give user 2 the ability to change printer settings or modify users? They are a member of the sudo group, and an admin, and all of these settings work just fine for user 1.

Maybe has something to do with polkit? <-- no idea what this is and I don't understand it at all.

Update: in case any of these files are related to the issue somehow, I have these:

/usr/share/polkit-1$ tree
.
├── actions
│   ├── com.hp.hplip.policy
│   ├── com.ubuntu.apport.policy
│   ├── com.ubuntu.languageselector.policy
│   ├── com.ubuntu.release-upgrader.policy
│   ├── com.ubuntu.softwareproperties.policy
│   ├── com.ubuntu.systemservice.policy
│   ├── com.ubuntu.update-notifier.policy
│   ├── com.ubuntu.usbcreator.policy
│   ├── com.ubuntu.welcome.policy
│   ├── com.ubuntu.whoopsiepreferences.policy
│   ├── io.snapcraft.snapd.policy
│   ├── org.a11y.brlapi.policy
│   ├── org.debian.apt.policy
│   ├── org.dpkg.pkexec.update-alternatives.policy
│   ├── org.freedesktop.accounts.policy
│   ├── org.freedesktop.bolt.policy
│   ├── org.freedesktop.color.policy
│   ├── org.freedesktop.fwupd.policy
│   ├── org.freedesktop.hostname1.policy
│   ├── org.freedesktop.locale1.policy
│   ├── org.freedesktop.login1.policy
│   ├── org.freedesktop.ModemManager1.policy
│   ├── org.freedesktop.NetworkManager.policy
│   ├── org.freedesktop.packagekit.policy
│   ├── org.freedesktop.packagekit.system-network-proxy-configure.policy
│   ├── org.freedesktop.pkexec.nomachine.policy
│   ├── org.freedesktop.policykit.policy
│   ├── org.freedesktop.RealtimeKit1.policy
│   ├── org.freedesktop.resolve1.policy
│   ├── org.freedesktop.systemd1.policy
│   ├── org.freedesktop.timedate1.policy
│   ├── org.freedesktop.UDisks2.policy
│   ├── org.gnome.controlcenter.datetime.policy
│   ├── org.gnome.controlcenter.remote-login-helper.policy
│   ├── org.gnome.controlcenter.user-accounts.policy
│   ├── org.gnome.DejaDup.policy
│   ├── org.gnome.gparted.policy
│   ├── org.gnome.settings-daemon.plugins.power.policy
│   ├── org.gnome.settings-daemon.plugins.wacom.policy
│   ├── org.gtk.vfs.file-operations.policy
│   ├── org.kde.kio.file.policy
│   ├── org.nemo.root.policy
│   ├── org.opensuse.cupspkhelper.mechanism.policy
│   ├── org.xfce.thunar.policy
│   └── org.x.xf86-video-intel.backlight-helper.policy
└── rules.d
    ├── 20-gnome-initial-setup.rules
    ├── 60-network-manager.rules
    ├── geoclue-2.0.rules
    ├── gnome-control-center.rules
    ├── org.freedesktop.bolt.rules
    ├── org.freedesktop.fwupd.rules
    ├── org.freedesktop.packagekit.rules
    ├── org.gtk.vfs.file-operations.rules
    └── systemd-networkd.rules

2 directories, 54 files

---

Also perhaps related:
Source: https://www.admin-magazine.com/Articles/Assigning-Privileges-with-sudo-and-PolicyKit

Related, but don't seem to help:

1. https://superuser.com/questions/980921/cant-unlock-system-settings-such-as-network-settings-to-edit-in-xubuntu
2. How can I give permission to a user be able to UNLOCK Users GUI to Create New Users when connected thru xRDP Sessions?
3. https://www.linuxquestions.org/questions/slackware-14/system-policy-prevents-modification-of-network-settings-for-all-users-4175420519/
4. *****https://wiki.archlinux.org/index.php/Polkit
5. https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html
6. https://help.ubuntu.com/stable/ubuntu-help/user-admin-change.html.en - doesn't work for me--button is greyed out
7. How can I create an administrator user from the command line? - doesn't seem to be what I need, and I already ran sudo usermod -aG sudo user2, then logged out and logged back in and user2 now shows sudo as one of the groups when I run groups, but it still won't work

Solution

I encountered the same issue. After a few days of investigation and reinstalling all the polkit and dbus software, I found that chrome-remote-desktop was at fault. I hope that helps.

Comments

[Gabriel Staples]

I'm upvoting this. I can't tell if this was the solution or not, but it appears my printer settings work now, and it may be because of this! However, I can't tell because I had already uninstalled Chrome Remote Desktop months ago as I describe in my answer here (see here for the uninstall command), for a different problem. On Linux, Chrome Remote Desktop seems to consistently cause problems, so I've switched to NoMachine. Anyway, I can't tell if this is the fix or not but to anyone else, it's worth a shot.

[Wes B.]

Wow! I actually updated to 20.04 because I encountered the automount issue! So sad to only see it now...

[Naofumi]

Thanks @WesB.! To complete the answer, you need 3 steps: $ sudo apt-get remove chrome-remote-desktop $ sudo apt-get autoremove and relogin.

[bohrax]

It seems like this solved a similar problem on Ubuntu 20.04 as well. Gnome Control Center fails quietly and requires looking at /var/log/syslog to see the message "Failed to add connection: Insufficient privileges".

[Gabriel Staples]

@Naofumi, the command I recommend to uninstall Chrome Remote Desktop is simply sudo apt autoremove chrome-remote-desktop

[Gabriel Staples]

I'm marking this answer as correct. Enough people have upvoted it that it seems to confirm it is the correct answer.

[gsingh2011]

Testing this on Ubuntu 21.10 with GNOME and the changes described here, I just needed to run sudo systemctl stop chrome-remote-desktop@<my user>.service, login out and back in, make the settings change, and then start the service. I didn't need to actually uninstall it.