7 Workgroup Manager Tricks to Keep your Managed Macs in Line

For all those OS X Administrators out there, keeping large numbers of Macs together can be tricky. Fortunately, over the years Apple has consistently improved it’s Mac Management application, Workgroup Manager, and it’s quite powerful. Here are seven little tricks that Workgroup Manager can do to make OS X administration easier.

The Managed Client App:

Before we get into the tricks, you’ll have to add in some extra features to Workgroup Manager. Why these aren’t included to begin with is beyond me.. but alas, it’s easy once you know what to do.

– Start up Workgroup Manager.
– Click on the Preferences tab.
– To the right, click on the Details tab.
– At the bottom, click the Plus button.

Working with Workgroup Manager

– Navigate to /System/Library/CoreServices.
– Select ManagedClient.app and click Add.

Working with Workgroup Manager

Now we can get into the advanced features Workgroup Manager offers.

1. Set the Desktop Picture:

While this won’t stop a user from changing the desktop picture, a quick logout and login will reset it back to what you want it to be. This is most useful in computer labs and other implementations where you want a uniform look.

– From the Detail pane, click Desktop Picture.
– Click the Pen button towards the bottom.
– Click to highlight the Often line.
– Click the New Key button at the top.
– Click the “New Item” key that appeared and choose “Background”

Working with Workgroup Manager

– Expand all the triangles until you reach the end.
– At the “Image Path” key, type in the exact file path to your preferred desktop image.

2. Controlling iTunes:

With this Workgroup Manager Trick, you can allow iTunes but restrict potential sources of network and liability problems. By managing some of iTunes functions – iTunes Store, Radio, Podcasts and Content Ratings you can customize iTunes to be usable for your environment.

– From the Detail pane, click iTunes.
– Click the Pen button towards the bottom.
– Click to highlight the Always line.
– Click the New Key button at the top.
– Set whichever keys you need for your situation.

Working with Workgroup Manager

3. Disabling Dashboard:

Dashboard.. How I loathe thee. Well that’s just my opinion, you may find that it’s little resource sucking gizmos, widgets, and doo-dads to be just lovely. But in a managed environment, Dashboard could be a source of unwanted apps, security risks and stability issues. So if you want to altogether shut it off, Workgroup Manager can do that too.

– From the Detail pane, click Dashboard.
– Click the Pen button towards the bottom.
– Click to highlight the Always line.
– Click the New Key button at the top.
– Click the new key and select “Disable Dashboard”.
– Change the value from false to true.

Working with Workgroup Manager

4. VPN Settings:

Need to make sure a large deployment can VPN into your network without a gigantic hassle? If you use OS X’s built in VPN client, send out those settings via Workgroup Manager!

– From the Detail pane, click VPN Settings.
– Click the Pen button towards the bottom.
– Click to highlight the Always line.
– Click the New Key button at the top.
– Select and set the appropriate keys for your network.

Working with Workgroup Manager

5. Set Home Page:

Setting a Home Page is a nice touch in labs. Or maybe your homepage is the key to logging in to the computer. Or maybe you’d like to prevent someone from setting a malware infested page, phishing site or otherwise inappropriate website as your lab’s homepage. Workgroup Manager can do this and more:

– From the Detail pane, click Internet Configuration.
– Click the Pen button towards the bottom.
– Click to highlight the Always line.
– Click the New Key button at the top.
– Select and set the appropriate keys.

Working with Workgroup Manager

While you are setting the Home Page, you can also set the default browser, email application and download location.

6. Turn on/off screen locking:

The Screen Locking feature is good for personal laptops but if you run a lab where everyone gets the same generic “user” login, this can be annoying. So, to turn it on for personal laptops but off in labs, here is what to set in Workgroup Manager.

– From the Detail pane, click Screen Saver.
– Click the Pen button towards the bottom.
– Click to highlight the Always line.
– Click the New Key button at the top.
– Click on the new key and select “Require Password”.
– Set the value to true for on and false for off.

Working with Workgroup Manager

7. Disabling Unwanted Applications:

In a computer lab, it’s essential to manage what can be run and what can not. This isn’t about being a fascist. It’s about keeping someone from uploading and running malware in your lab. In the case of schools, it may be to prevent children from using your lab for what they want (games) when they should be doing something else (work).

– In Workgroup Manager, click the Overview tab.
– Click the Applications icon.
– Select “Always” in the Manage: section.
– Check the “Restrict which applications are allowed to launch” checkbox.

Working with Workgroup Manager

– Click the “Folders” tab.
– In the first area, select Applications you want to disable.
– In the second area, select Application folders you want to allow.

Working with Workgroup Manager

Note: As a rule, if you are going to manage applications, ALWAYS disallow the /Users/ folders. This will prevent the downloading and launching of apps on the desktop. I’d also recommend disabling .DMGs from being opened to prevent apps running off USB drives. That’s done in the “Media Access” section, under the “Other Media” tab.

Wait, there’s more:

While the ManagedClient.app adds in some extra advanced features to Workgroup Manager, you can actually use Workgroup Manager to manipulate any .plist file in a managed machine.

For any Application that uses .plists for preferences, they can be added in and tweaked via the details pane. If you aren’t sure how the .plist should look, just set the application the way you want and copy the appropriate .plist file in.

15 thoughts on “7 Workgroup Manager Tricks to Keep your Managed Macs in Line

  1. I cannot get the “Set Home Page” feature to work in OSX Server 10.5.8 with all the latest updates. It seems to have no effect on my group preferences. Any ideas?

  2. Jan – Try the following:

    – Make sure the Managed Machine is properly attached to the OS X Server.
    – Double check the ethernet address is correct
    – Make sure the machine is in the appropriate group that has the setting.
    – Log out of the machine and log back in (it may take two or three tries for it to sync up)
    – Be sure to be using Safari, Firefox won’t listen to the settings.

    Also, make sure you have the latest Server Admin Tools update – Apple will release updates for this around the same time they release the OS X Server updates.

    If it still wont work, I’d check with Apple Support to see if there’s a known issue about this.

  3. We have serious performance issues and very slow login wait times on our network. We only need a home folder for each student so they can save documents no matter where they are on the network. Can all other user profile settings be turned off? Thanks!

  4. Are you using the Network Home folders over wireless? If so, that’s exactly why Apple recommends you don’t do that. Even over a wired network, with enough traffic Network Homes can be sluggish.

    What you should do is have local home folders, where the home folder resides on the machine itself, rather than a server. Do note that the first login will take a while as the home folder is being built. Subsequent logins will be much faster.

    What you can do next for the students is create either a network folder that they can store documents in – that mounts on login, or sync just a particular folder (say, Documents).

  5. Any thoughts on disabling speakers on the computers while retaining the use of headphones? We have several macs in student classrooms, and would like to disable the speakers, but allow kids to use headphones.

  6. Unfortunately OS X views the speakers/headphones as one Built-In output.

    You may be able to get around this with USB headphones rather than standard 1/8″ jack headphones, and making this the default output instead. Then lock the Sound preference pane to keep users from changing the settings.

  7. Is there anyway to setup the mouse preferences for users? For instance, we want the right click to work as the secondary button and turn off the dashboard for the center button.

  8. I was able to turn off the dashboard by following your directions above, but I am still wondering if there is a way to setup the mouse preferences through Workgroup Manager. Does anyone know?

  9. @ Ann,

    Sorry you had to wait for a response but controlling the mouse via Workgroup Manager is not going to be an easy one but it’s possible.

    First, install the Property List Editor from Apple – I can’t find the direct link but I do remember that it’s on either the OS X Server Install DVD or part of the Admin Tools package. Alternatively, it’s bundled with XCode.

    You’re going to have to play with the preference files:


    My suggestion is to take the standard settings, tweak the mouse settings the way you like and note the differences in the .plist files. Look at the date/time modified to give you a hint for which ones are changing.

    Once you’ve got them set and know which .plists are affected, in Workgroup manager, Highlight the group you want it to affect. Then under the Details pane, click the plus sign and import those .plist files. You’ll also be able to edit the plist files through Workgroup Manager’s editor.

    This is a much more advanced way of working with Workgroup Manager but it’s very powerful and can be used for all sorts of settings.

  10. Thanks David! I’ll give it a try.

  11. I can’t seem to find the com.apple.systempreferences.plist
    com.apple.universalaccess.plist on the list. Do they need to be imported from somewhere?

  12. @ Ann:

    They are located in ~/Library/Preferences and will need to be manually imported into Workgroup Manager.

  13. Hi David,
    thx for that your info. I was wondering if you know how to set the Safari bookmarks using workgroup manager. I already tried doing it by copying the preferences for the entire application and/or only using the bookmark.plist from ~/Library/Safary/Bookmarks.plist
    None of my techniques work.


  14. @ Jason,

    It looks like you can adjust Safari bookmarks by importing the bookmarks.plist file into Workgroup Manager. It will show up towards the top as “Bookmarks”. Before you put in the .plist file, set the bookmarks you want. I haven’t tested it yet but in theory it should work. I’ll let you know after I test it.

  15. Sorry for the delay David to reply…It didn’t work. as you said in theory it should work. The bookmarks bar just display the default bookmark on it. I do not know what else to try or what in doing wrong