Admin accounts for teachers and students?

[juan]

We are just getting ready to deploy about 200 Macbooks (about 40 teacher and 160 student machines) and only 1 technician responsible for the upkeep and administration of these machines. Our problem is that we want to restrict these accounts so they do not install unauthorized software etc. but, if we do this, they are not allowed to install software updates either. Is there any way around this? I have a feeling I'll be overwhelmed with trying to authenticate as admin on all of these machines when software updates are released.

 

 

I do have Apple Remote Desktop but I've not had a lot of time to see how it can help me yet. Does anyone with experience in a similar environment have any suggestions for me while I keep researching the issue? Is it better to just go ahead and grant admin privileges to all users? Thanks for you time!

[HodgeHi]

It really depends on how much control you want over these machines i think. The reason i say this is because not all applications come through Software Update. For example Microsoft Office use their own updating tool (it did in 2004 version, not sure about 2008) which means i think that the user would need admin rights to update this software anyway.

 

As for the software update, i have just tested the process to see if any changes have happened since i tried it last...

 

In ARD use the command

softwareupdate -i -a

 

This runs as Root. I am not sure if this tool needs a logged in user. I don't think that it does but if it does then you can log them in remotely using ARD anyway.

 

If you keep the same configuration (and if you use Net-Restore to image them all then you will ) you can set up a group in ARD and then choose Unix tool and type in:

 

osascript -e 'tell application "System Events"' -e 'keystroke "admin username"' -e 'keystroke tab' -e 'delay 0.5' -e 'keystroke "admin password"' -e 'delay 0.5' -e 'keystroke tab' -e 'keystroke return' -e 'end tell'

 

This will log each machine in as the admin user all at the same time.

 

Hope this helps.