I am trying to run dockutil on my management account to add some things that are needed in the dock for that account. That account also serves as the Admin account on our machines. Running the script after I am logged into that account seems to work, but doesn't seem to work during FirstRun. The User Template dock plist gets modified the way it should and it's in the same script, so I am thinking the management account is created before dockutil modifies the User Template dock plist. I could probably just copy a modified plist file for that account and call it a day but I wanted to understand why it doesn't work. Possibly because dockutil is running the script as root?
I'm running 10.12.5 and the latest version of dockutil 2.0.5 it seems to be working as it should with all the other accounts. I have the first part of the script set the User Template dock plist file and the second part (should) sets the dock plist for the management account. I've got the script packed in a PKG file for the FirstRun script. dockutil gets installed first, and then the begining of the script sleeps for 30 seconds to allow dockutil to get installed before trying to apply any settings.
@rqomsiya Since I don't want to modify the 10.12.5 image from Apple, I take a dock plist and copy it to /tmp and package it up to be copied to my management account with it's default icons that we use. I use the same dock plist and copy it to the User Templates folder where I just overwrite it's contents with dockutil. Not sure if that's the best way but it works. I could probably disable SIP and play around with plist files but there has to be another way.
@seann Yes I have played around with the options. I'm sure it's SIP causing the 4 icons (Siri, Maps, iBooks and Photos) to still be in the dock. All of the other Apple apps are gone. It's working for now. I think I'm going to create a LaunchAgent that runs at each login that uses dockutil to delete the icons I don't want.