WGM restrict access to local HDD

[haris2887]

hi alll

i want to prevent a user from accessing, how can i do this via WGM ?

 

I also have ARD correctly setup if you want me to send unix commands per computer...

[AntonioRocco]

Hi

 

It depends on what you mean by restricting access?

 

You can't deny any user at least read only access to Applications installed on that workstation. If you did the user would not be able to launch any applications stored in /Applications.

 

You should be aware that any user logging into any Mac other than the local administrator, or any other user (network or otherwise) that has been made an administrator using a non-obvious, non-gui method, has read only access to the internal drive anyway.

 

Or do you mean you want to deny them the view of the internal drive completely? If this is what you want simply apply the Simple Finder MCX in WorkGroup Manager. Ultimately you may find this to restrictive? You could apply a Finder MCX to not display the drive but you'd have to amend the Sidebars property list as well. You may also want to think about disabling the Go to Folder option in the Go menu as well.

 

You could use ARD to send a terminal command hiding the drive completely:

 

sudo setfile -a V /Volumes/Nameofthedrive

 

The above won't work for 10.7. You should be aware that any of these commands will hide the drive for everyone including the local administrator. You'd have to use the Go to Folder option in the Go Menu if you wanted to access the hard drive as the local adminstrator and sometimes there is a need to do this.

 

What will work for all systems is:

 

sudo chflags hidden /Nameofthedrive

 

Which I think will be your best option? You can revert back to the default with:

 

sudo chflags nohidden /NameoftheDrive

 

You can drag/drop the internal drive into a terminal window to see the full path. Enter the path into the UNIX Section in ARD preceded by the command above. If it was me I would not do this as it's purely cosmetic and as already mentioned, any user other than the local administrator can't do any real damage to the OS or anything else stored on that drive.

 

If your question is really about denying access to Applications in the Utilities folder there are (IMO) better ways to do this.

 

HTH?

 

Antonio Rocco (ACSA)

Edited December 5, 2011 by AntonioRocco