Disable access to System Preferences
In trying to lock down the machines in a small Mac lab, I came across an interesting piece of advice from John Mairs who was tasked with basically the same thing. He suggests disabling access to System Preferences because it “accomplishes (and halfway accomplishes) several things. First, it completely prevents students from changing all settings on the computer. This includes account changes, security settings, Apple Remote Desktop settings, and screen saver settings.” Valid points certainly, but what I think is much more interesting is the way that he chooses to disable the System Preferences access: changing the applications permissions using the command line. This is crafty thinking and it works:
Disable all access to System Preferences
sudo chmod 000 /Applications/System\ Preferences.app
Re-enable access to System Preferences:
sudo chmod 774 /Applications/System\ Preferences.app
Generally speaking, if you don’t know what you’re doing with permissions changes and chmod, you should leave them alone since it can cause all sorts of problems and unwanted behavior. With that in mind, this is certainly an effective technique at limiting access to certain applications within Mac OS X.
Note: thanks to Jasper for pointing out the syntax error and proper permissions.
[ via JohnMairs.com ]
I LOVE this method, its quick and easy, however when I tried this in terminal, I got a “chmod: Invalid file mode: /Applications/System Preferences.app” did I miss something?
That won’t work – the file mode goes before the path:
chmod 000 /Applications/System\ Preferences.app
And don’t change it to 777 – that’s silly. Change it to 774 (what it was before you 000d it!)
chmod 774 /Applications/System\ Preferences.app
You’ll probably need to do this as root, too.
Hmm.. If one runs a repair disk permissions in the disk utility, won’t that revert the permissions back to default?
I don’t know what Jasper is thinking of, but I tried using 774. I could not open system preferences. Changing it to 777 was the only way to restore full functionality.
I agree with Nick. 774 does not work, at least with Snow Leopard version 10.6.6. I had to use 777 also. I almost freaked out when 774 did not work.. phew 777 was able to revert… won’t do this again
and i think it’s a really bad idea.
Yup 774 won’t work. The least you can do to restore it is use 775 to enable read and execute flag.
Hi
The system preference of my mac OS is not working when I click on it, it does nothing. I dont know what have to do is it possible to enable it from graphical user interface.
thank you.
Just go into Accounts/Parental Controls /select the controlled account/Finder and Systems/Config/check This user can only use these applications/allow/click applications/scroll to Prefs and uncheck. OK