Monitor / block installation of unauthorised apps

[DanJ_LRSFC]

Is there a way we can monitor and/or block installation of unauthorised applications by non-administrators on macOS, while still allowing them to install authorised applications through Self Service?

Thanks,
Dan Jackson (Senior ITServices Technician)
Long Road Sixth Form College
Cambridge, UK.

[al786]

You could try "restricted software" to do this and type in all the apps to kill the process and delete the app from the machines of non-administrators through a smart group.

The better option may be to use "Configuration Profile" > Restrictions > and uncheck "allow non-admins to install..." you could also restrict the applications allowed to launch and further refine this by also using a smart group of the machines not-owned by an admin (unless you have multiple users per machine and in that case just uncheck "allow non admins"

[DanJ_LRSFC]

@al786 The "Require admin password to install or update apps" setting is the one at issue. With this enabled, the user is unable to install a Mac App Store app from Self Service (they are prompted for admin credentials by "storedownloadd").

I was wondering, if I was to uncheck this setting, whether I could monitor or prevent students from installing other apps (for example from downloads or from USB sticks).