MCX, blocked apps workaround

[Flash]

My “too-smart-for-their-own-good” students have found yet another method to run apps which are blocked by MCX settings. Any brilliant ideas how to stop this, besides taking away access to Keyboard & Mouse pane? Blocked apps will launch flawlessly if the user merely sets their right button to open the blocked app.

[b]What doesn’t work:[/b]
1. Deleting Dashboard from the Apps folder does not keep them from running Dashboard with the above right button method. I cannot explain this. Perhaps there is binary somewhere that needs to be deleted?

2. Custom Dashboard and AppleHIDMouse plists in the Details tab of Group Preferences. For instance, a Dashboard plist Key “mcx-disabled”, Type boolean, with Value=true. Or forcing the right button to a certain value. These prefs are forcibly applied at login, but that doesn’t stop the student from changing it for that session.

Please, help me outsmart these aspiring Milnicks.

[johnaris]

I had this problem before but haven’t really solve it at all, where dashboard is not allowed to run, but still many students/users can open it. I tried some test really why they(users) can open it, I was amaze that even if you will delete the dashboard application, pressing F12 will still open it. I haven’t check if there is a dashboard app in CoreServices folder, the remedy i made is that when users login usually at 10 in the morning, I will ARD them and sending unix command to stop the dashboard running, I will perform this only once.

defaults write com.apple.dashboard mcx-disabled -boolean YES

the next time they will login they cannot access it even pressing F12 as long as they are using their account, but if its a new account you will have to perform it again. It’s kinda tiring.

or

I will delete the Dashboard in the Application folder and set the shortcut F12 to perform nothing when they pressed it in the Systems Preferences, but this is a very tiring to do.

What I really wanted to do is how to disable the Dashboard using the WGM just like any other apps anyone have ideas? Teach Us How…

[Flash]

Well, for lack of a better solution, this works:

1. Disallow access to Mouse, Keyboard and Universal Access Panes.
2. Create these two plist files as desired (com.apple.driver.AppleHIDMouse.plist & com.apple.universalaccess.plist), these include all mouse settings and F-key settings.
3. Under Details Tab of Group Prefs, add pre-made plist files.

[factor]

[QUOTE][u]Quote by: Flash[/u][p]
My “too-smart-for-their-own-good” students have found yet another method to run apps which are blocked by MCX settings. Any brilliant ideas how to stop this, besides taking away access to Keyboard & Mouse pane? Blocked apps will launch flawlessly if the user merely sets their right button to open the blocked app.

[b]What doesn’t work:[/b]
1. Deleting Dashboard from the Apps folder does not keep them from running Dashboard with the above right button method. I cannot explain this. Perhaps there is binary somewhere that needs to be deleted?

2. Custom Dashboard and AppleHIDMouse plists in the Details tab of Group Preferences. For instance, a Dashboard plist Key “mcx-disabled”, Type boolean, with Value=true. Or forcing the right button to a certain value. These prefs are forcibly applied at login, but that doesn’t stop the student from changing it for that session.

Please, help me outsmart these aspiring Milnicks.[/p][/QUOTE]

Dashboard widgets don’t run too well without this:
/System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app

(do a “ps -a” after you have had the Dashboard open)
Haven’t tried removing it (I don’t have the need) your Mac may or may not be happy after that.

Note — the reason the “/Applicaitons/Dashboard.app” thingo isn’t actually required is that the widgets are not child processes of such a program, they are child processes of the Dock but simply display on a virtual desktop. Dashboard appears to be tied right into the windowserver.

[mikemchargue]

[QUOTE][u]Quote by: MacTroll[/u][p]Yeah, there’s no real great solutions here.

Casper has a solution based around a deamon that constantly looks for banned names and paths in the process list and kills them. I think others have come up with their own along this line as well.[/p][/QUOTE]

We’ve recently gone with Casper as well. The blocked apps functionality plus use of Composer all well worth the price of admission.

[Author]

Posts