Blocking Apple Icon Menu

[khurram]

Can we block About This Mac menu from the main system Apple icon menu

[mm2270]

I don't believe so, but… just curious about what the need is here? I don't think I've ever heard of anyone wanting to block that, until now.

[khurram]

We have blocked the System Preferences from MCX --> Black List folder.
When the user try to access the About This Mac and then click on More Info... then the permission denied message keep recurring on the screen. May be the other way would be to open the Preferences and block the items inside System Preferences one by one.

[PeterClarke]

Does not appear to make much sense - why would you even want to do that.. ??

This leads to useful diagnostic info..

Unless you are trying to hide facts from some users -- that they have a differently specified Mac, then other users have..
I can see no other reason for doing this...

[nigelg]

@khurram In 10.9.5 you can remove it by editing /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/Resources/English.lproj/StandardMenus.nib/objects.xib and removing the following lines:-

  <object class="IBCarbonMenuItem" id="220">
          <string name="title">About This Mac</string>
          <boolean name="dynamic">TRUE</boolean>
          <boolean name="updateSingleItem">TRUE</boolean>
          <ostype name="command">abtm</ostype>
        </object>

and the related reference later in the file:

<reference idRef="220"/>

Make a backup of the file before you edit it and be prepared to ssh back into the Mac to copy it back in place if you make a mistake. Making a mistake one time left me with a loginwindow that constantly refreshed and wouldn't let me enter any text.

I am looking at using the same technique to remove other options from the Apple menu.

[gregneagle]

This technique (editing files in /System/Library/*) will stop working in El Capitan, so I would not build anything new based on this technique, and would be actively looking to disentangle myself from any existing uses of this technique.

Apple has been saying for years not to make changes in /System; now they will enforce that.

[mm2270]

Even before Apple drops the hammer on this kind of stuff come 10.11, I don't think I would ever even consider doing this. Editing nib files directly in the OS? That's kind of crazy and asking for trouble, or destabilizing your systems at the least.
If management asked me to do something like this and the only way to accomplish it was editing /System/Library/ files directly, I believe my answer would be 'its not possible. Sorry'

[jarednichols]

Simple Finder removes System Preferences (and many other things) from the Apple Menu. You may want to go down that route if you want to stay on the support reservation.

[khurram]

The query was that user shouldn't have access to System Preferences. Now how would we block it from the Dock and then from the Apple menu --> System Preferences. I know that even inside System Preference it asks users to enter admin password to make changes but not for everything, for instance energy saver, language, display settings etc. Such settings (if disturbed) can bring the macbook into unusable state.

@nigelg Thanks for providing the script. I might not be using it because I think there should be some other appropriate option available.

[mm2270]

If that's the end goal, to stop students from using System Preferences, there are much better options.

• A configuration profile can grey out any or all preference panes.
• You can add System Preferences to a Restricted Software item to kill the app as soon as it's launched.
• You can look at what Jared mentioned about Simple Finder.

Any of the above options would make far more sense than trying to somehow kill the Apple menu.

[bentoms]

Or add the "System Preferences.app" to restricted software.

[nigelg]

I have been trying to offer the user an option to quit the logout process and return to the desktop based on the results of a script to work out their file quota. Best option I found so far was to remove the logout button and create a logout app to for them to run instead.

Im open to suggestions if theres an alternative.

@gregneagle Assuming you are referring to System Integrity, i read that you can opt to turn it off. Not ideal I agree but its not impossible to carry out this kind of modification in 10.11?

[bradtchapman]

@nigelg It appears at the moment that the computers have to be rebooted into Recovery mode to turn off SIP. This will cost you about 5 minutes of time per machine. And besides, you're opening them up to a whole host of security risks.

It's better to use Configuration Profiles and Restricted Software.