In the past we've been using Deepfreeze to basically lock down and secure our non-managed, stand alone macs in labs. With the new OS and the APFS, deepfreeze does not currently have a version that will work. The closest estimate of when they'll have it ready is "this year". Meanwhile, we'll be deploying close to 100+ macs to labs coming September 1st. Other than turning admin access off, what else can I do to secure them as much as possible? They will have McAfee and are stand alone with a single, generic log on.