03-06-2009, 08:21 AM

Hi everyone, I work as a technician in a UK school and we have run into an issue with disabling applications such as System Preferences and Terminal on a standard local account.

Basically we do not want students to have access to these types of programs and I would like to know if it's possible to disable them completely, without the use of parental controls (as we have encountered problems when running certain applications if this is enabled.)

I have found that changing the permissions of these applications will disable the user from clicking on that specific icon, but I've found that it is still possible to run the program if the same icon from another machine copied over (eg. via USB).

If anyone could help (even if it's just to stop terminal and system preferences) I would be very grateful.

thanks

03-06-2009, 12:47 PM

I think Parental Controls is the best idea to be honest. BUT, there is a way to do this without the use of parental controls. Basically, make a shared folder called 'Applications2.' Then copy all the applications that you want them to have access to and paste them into that shared folder. (Make sure you lock the folder so they cannot edit it.) Then, you can block them all from being able to view the real 'Applications' folder. I did this, it worked for me!

But it will only work on a standard account, you cant limit the access to file viewing on an admin account.


[Also, there is a software that lets you completely block people with standard accounts from opening certain files from USB sticks, such as applications etc. However, i am afraid i have forgotten the name of the application at this moment in time. I'll phone my colleague, who works with this app, and I'll post another reply if i manage to find out]

Oh, and seeing that you sound like the kind of person in the business, can i also ask
you a quick question?-- Do you know of any good software that enables you to send messages to local standard accounts on mac? Like maybe a really simple email program that doesn't use the internet or receive any internet emails, just mail from the others using the same mac as them. Or something like a program that displays messages on the desktop etc.? Thanks!


Hope this helped!

03-06-2009, 05:26 PM

Parental Controls really is the way to go. Instead of locking out System Preferences and the Terminal, it will lock managed users in to applications you specify. Thus, it prevents them from installing their own applications.

03-08-2009, 11:49 AM

Thanks for your advice guys, I appreciate your help.

After reading both of your responses, I think it looks as though parental controls are my only option. The only problem that I have found with this is that some programs (Garageband, Microsoft Office apps and Adobe products, to list a few) seem to rely on other files, which are not listed within the parental control section, to be able to function correctly.

eg. When I open Microsoft Word within a local account with parental controls enabled (and Word put onto the allow list), a message appears stating that the application 'fontcache' is not on the list of allowed applications.

We do have an option to add this to our list of allowed applications so that this message will not appear again, but what I don't want is to upload an image of my mac, drop it onto 30+ machines only to find that a program is not working due to an issue with a blocked application that I may have missed during testing, or that needs to be accessed when a specific function is launched.

As for your question Mr Macintosh, sorry I can't help you I'm afraid. Our school really only uses network accounts. It is only recently that we have looked into using local accounts for one of our departments as it seems that there are some major functionality issues with the network accounts and one of the applications that we use. If you do manage to find a program that does this though I'd be interested in knowing what it is for future reference.

Thanks again.