Locking Down System Preferences

[geo52geo]

How do I lock down System Preferences on the MacBooks so students cannot make any changes?

[bentoms]

You can do this via either managed preferences or config profiles.

Both have payloads available in the JSS.

[matt_jamison]

It's a pain with Config Profiles though, since Casper says restrict access but it's actually the opposite, you have to select the ones you want to ALLOW.

You may be better off running a script and changing the permissions in /System/Library/PreferencePanes/ A chmod(NOT recursive) 700 on any of those will make it so that root is the only one who can access it, assuming the students are admins.

[talkingmoose]

The simple answer is "Don't make students admins."

If you decide for whatever reason students will be admins on their computers then you'll be playing whack-a-mole trying to outsmart them with different gimmicks to keep them restricted. With a little patience and Googling anyone who is an admin on a computer can work around whatever you attempt to lock down.

Your only recourse in this matter would be defining an Acceptable Use Policy (AUP) and getting the backing of your school board. Then this becomes a people issue rather than a technical issue.