Disable access to System Preferences
In trying to lock down the machines in a small Mac lab, I came across an interesting piece of advice from John Mairs who was tasked with basically the same thing. He suggests disabling access to System Preferences because it “accomplishes (and halfway accomplishes) several things. First, it completely prevents students from changing all settings on the computer. This includes account changes, security settings, Apple Remote Desktop settings, and screen saver settings.” Valid points certainly, but what I think is much more interesting is the way that he chooses to disable the System Preferences access: changing the applications permissions using the command line. This is crafty thinking and it works:
Disable all access to System Preferences
sudo chmod 000 /Applications/System\ Preferences.app
Re-enable access to System Preferences:
sudo chmod 774 /Applications/System\ Preferences.app
Generally speaking, if you don’t know what you’re doing with permissions changes and chmod, you should leave them alone since it can cause all sorts of problems and unwanted behavior. With that in mind, this is certainly an effective technique at limiting access to certain applications within Mac OS X.
Note: thanks to Jasper for pointing out the syntax error and proper permissions.
[ via JohnMairs.com ]