Blocking Applications

There is a restricted software section under the Management tab of your JSS.

Then you can go to the extreme like some have and restrict applications from running anywhere but the applications folder using MCX, and make sure permissions are such that only admins can put any applications in the applications folder, which should be default.

Craig E

I use MCX to block application access by file path. Local administrators can run what they want, all OD accounts get this restriction via a group policy. com.apple.applicationaccess.new is the plist file you create. here is a screen shot of what mine looks like:

As you can see, I pretty much block everything outside of /Applications. This means that any app I don't want users to run gets copied into /Applications/Utilities since users cannot access that. The one annoying caveat to this is that when genius developers, like Adobe, decide to put licensing apps in /Library/Application Support, you must go in and approve that full path so the app can go online and validate your Adobe license.

This also does not allow any user to run apps from their desktop or from a thumb drive.

-Tom