Internet Accounts restriction

[lubkens05]

Is there a way to control or restrict the 'Internet Accounts' app in System Preferences to prevent users from adding accounts like Facebook/Twitter right to their Mac?

[StevenVig]

You could always delete the prefpane file from the OS Library, in your build, and then package it for deployment should the need for it arise again?

[mm2270]

Yes, with MCX or Configuration Profiles if you don't mind blocking the Preference Pane from being used at all. Use the "Enabled System Preference Panes" under com.apple.systempreferences if using MCX, or under "Restrictions" if using Config Profiles.

Also, If ypu're talking about Macs running 10.9, apparently Apple finally added in a blacklist approach to this, rather than the previously only option which was to whitelist the panes you wanted to allow. The whitelist approach meant that any new Preference Panes installed after would be blocked/grayed out by default until you added them into the whitelist. This is either good or bad depending on your point of view and the type of environment you manage.

[tron_jones]

Don't know if it's just my environment but i'm not seeing an option in the JSS under configuration profiles to enable "Internet Accounts" in restrictions. Was it left out? Running 9.24.

[mm2270]

Try using "Mail, Contacts and Calendars" For 10.8 and lower that's what it was called. In Mavericks the name changed to Internet Accounts. However the pertinent item is the pane's Bundle Identifier, which is still "com.apple.preference.internet" so it will work, or at least it does for us.

[jrserapio]

@mm2270

Sorry for the late post. What is the blacklist method? Im still using the whitelist method and managing the third party pref panes is a PITA.

[mm2270]

@jrserapio - Here is an article on afp548.com from Sam Keeley that describes the change introduced with Mavericks.
http://www.afp548.com/2013/12/16/system-preferences-profiles-in-mavericks-plus-a-security-hole/
(The same article also details a security issue that has existed in OS X now for at least the last 3 major OSes if not going back further, around disabled Preference Panes)
Right now this option only shows up with Profile Manager 3 under OS X Server, and again, only wrks with 10.9.x. I don't believe JAMF has incorporated this very important change into the Casper Suite. I'm really hoping they do that soon. I think there's a FR here to have them add that.

In the interim, an example profile xml is provided in the article, so you should be able to build your own right now if you want.

[Nix4Life]

@mm2270 thanks for the link. this seems very interesting. I'm gonna try this out with puppet in a couple of days

LS

[jrserapio]

@mm2270
Thanks for the response. I mostly use the JSS. Guess its time to fire up OSX server and poke around.
I will have to look for that FR and vote it up.