Account setup for computer lab

[demobomber]

Hi

I am currently setting up a few iMacs for my computer lab.

I use the Parental Controls to freeze the dock and to restrict the use of applications to only specific ones, and it's all working great.

It would just be great to have a way to restrict access to the "Library" folder in the "User" folder, as well as the "Developer", "Library", and "System" folders at the "Macintosh HD" level. I know using the permissions is not possible, and all the monitoring apps I've seen only enable you to restore the account and see what's been done and moved around.

So I am looking for a way to disable user access to those folders, so that when they try to open them they get a message saying they can't access it, just like in the windows-based computer labs.

Thanks for the help

 

[macrem]

Why not just enable the guest account? When a guest logs out, the guest home folder is reset. Otherwise there are many other ways to skin a cat, such as creating groups that only specific users have access to.

ps: it sounds like Simple Finder would also meet your goal.

 

[larkost]

I too think that using the Simple Finder is probably the best way of achieving your probable goal. But I will throw out one more possibility:

You could mark the folders you don't want them exploring in as hidden. With a little creativity people can still explore with the Finder (assuming you don't use simple finder), and if they have access to Terminal.app they can still explore there. I don't really understand why you are trying to curtail exploring, since just viewing the contents of those folders is not going to be harmful to anyone (it is making changes that you should be guarding against, and that should already be taken care of).

Oh... and you could change the permissions of the folder to remove the read access for users. As long as they still have execute permissions on the folder they should be able to get at the files within, but will not be able to search folders. Do not use recursive changes for this, since you don't want to kill the executables in there, pick a level and do that. Creative people will still be able to get through this by navigating directly to the folders they want inside you exclusion zone, but it does get rid of the casual browser.

 

[demobomber]

thanks