Learn MCX and Configuration Profile

There is this book that covers MCX: http://www.amazon.com/Enterprise-Managed-Preferences-Edward-Marczak/dp/1430229373

The authors are quite active in the Mac community and many people still reference this book even though Apple is slowly moving away from MCX toward Configuration Profiles.

At the end of the day, all you're doing is managing preferences. https://github.com/timsutton/mcxToProfile is a pretty good tool for making custom profiles. Casper also has the option of making profiles out of PLIST files. Create a new config profile, go to the custom payload, and upload the PLIST with the preferences you wish to manage.

Ultimately if you're making your own custom profiles make sure that you are testing the particular preference you want. Don't just copy an entire PLIST as it may include more preferences than you want to manage. Most preferences will be located in ~/Library/Preferences, but occasionally some vendors make preferences that aren't in the .plist format so they can't be managed via MCX or Profiles. And then you have apps that are sandboxed which means profiles do not effect them as their settings are usually located under ~/Library/Containers/ or ~/Library/Group Containers/.

On a non-technical note, only manage preferences when there is a particular need. It's going to effect your clients and each client will work in different ways. Don't lock things down without a reason.

And then you have apps that are sandboxed which means profiles do not effect them as their settings are usually located under ~/Library/Containers/ or ~/Library/Group Containers/.

I've read that a couple of times now but i doubt that it's true.
I tested this by creating a profile for com.microsoft.Outlook with Weather_in_celsius = 1,
which is in ~/Library/Containers/. Works fine for me...

And then you have apps that are sandboxed which means profiles do not effect them as their settings are usually located under ~/Library/Containers/ or ~/Library/Group Containers/.

Configuration profiles do affect sandboxed apps.

-Greg

@gregneagle That's new to me. Maybe it's the app I was testing, but it didn't work for me (I think the app in question was MS Remote Desktop). Do you have an app (and a preference value as an example) that I could test?

@Chris Hmm I'll have to test this out now. I tested it out in one MS app which was MS Remote Desktop and I forget the value but it didn't work. Looks like I'll need to go back and do some more testing. Thanks for the correction.

bpavlov: What? An app from Microsoft that doesn't pay attention to standard OS X preferences? Unheard of!! <cough>Office 2016</cough>

There are lots of apps that do funky things that make them incompatible with managed preferences, but sandboxing is not one of those things.

@bpavlov Remote Desktop has a lot of quirks with the plist, as I found with this post.

So might be worth looking at it again, profiles should work...