Are the Macs bound to AD or any directory service? Why not just take away admin access? This way you won't have to deal with people mucking around the system.

Yes our I.T. dept very much likes to have our machines bound to AD. Users do NOT have any admin access.

If the users do not have admin access what benefit does DeepFreeze provide? The users can't really do much outside of their home folder. And if you're managing preferences then you can lock down things even further and/or set the desktop experience you want.

I have no idea what benefit deep freeze would provide honestly, that's why I'm asking. I'm trying to stay open, and neutral to the idea; however, most everyone I have spoke to within our IT dept, has the opinion that Deep Freeze, is un-necessary and will simply make things more complicated to manage within the .jss, with regard to having to run scripts to thaw- then make adjustments then re -freeze again of course...

I will concur with the others in your IT department. If your users had admin access then maybe you could make an argument for using it. But not in this case. Good on you for keeping an open mind though. Always worth exploring and questioning processes/workflows. Very often people tend to just keep doing something because that's been the status quo for years and they forget the reason they actually started that workflow/process which may no longer be relevant.

I'd side with them as well. As an alternative, try setting up the autorun features of the JSS. That way you can have the machines reset fairly often.

Deep Freeze isn't necessary and makes patching and sending fixes out more difficult, but users not being admins isn't enough either IMO.

Look into config profiles that whitelist where apps can run from to lock down the system so apps can only be launched where students don't have read/write access.

To keep the system clean, consider a config profile or script to wipe user accounts off the machine, as well.

@CasperSally Do you have a good link to a script like that? We have a lab that we're moving from DeepFreeze for all the obvious reasons now that we're on Casper. Domain accounts, bound by Casper, force local home directory, etc. Mostly just the default settings. We're looking to not delete user directories immediately, but rather after X days of inactivity. Had a lot of other things on my plate, so I've backburnered it for a bit.

link

It turns out one of our art colleges has Deep Freeze in place on a number of studio machines (Pro Tools HD systems, with sophisticated images, loaded with 3rd party pluggins' etc. It has been a pain in the a$$ to work with to say the least..and i'm not even dug in deep just yet. I don't even know where to begin, in fact... after ssh'ing into a number of them and having them re-boot thawed via a simple script, I would lose remote admin access (no idea why)...then have to go touch them, and dig into sys prefs... I'm NOT a fan of Deep Freeze right now...