10.9.x and Mac App Store - Non Admin Users Can Install Apps ??

[rcorbin]

Came across this by accident this morning and I'm a bit confused. Did I miss a thread somewhere ? (I've looked around and I don't see anything talking about this.)

Using a test non admin local account on a 10.9.2 machine I was able to install an app from the Mac app store on that machine. I can pick any legit Apple ID to do so. I thought the user needed to be in the _appstore group for this to happen ? Or at least an admin account. Is this something new in 10.9 that I've missed ? I thought the user would need to have write access to the Applications folder. Went back to a 10.8.5 machine and sure enough it doesn't work. It asks for an admin password. So this behavior seems to be a 10.9 thing.

For a one to one deployment I can see this as an ok thing. In some ways it could be a bonus. I was looking for ways to do this using the _appstore group. But for labs this could be a bit of a disaster. That would mean that any student with an Apple ID could install apps from the Mac App store on those machines. Do I have this right ? I've tested this on a couple of different machines.

[gregneagle · Accepted solution]

This is new behavior in Mavericks, and can be controlled with a configuration profile.

Here's an example:
https://github.com/gregneagle/profiles/blob/master/mavericks_app_store.mobileconfig

[rcorbin]

Ok so it looks like there is a "Restrict App Store to software updates only". Probably a good option for labs. I'm not sure that I've ever seen that "Allow App Store app adoption" item before either.

[tron_jones]

This is expected behavior with Mavericks. I believe the way apps are sandboxed and signed by developers approved by Apple allows this to be a pretty safe process for all users. You can also control this from the JSS itself.

Configuration Profiles --> Restrictions --> Applications.