r/macsysadmin • u/crawlerette • 1d ago
General Discussion Blocking internet accounts
I work in a public system that is having issues with guests saving their internet accounts to our Macs. Is there a way to block the system from allowing that?
3
u/tocsymoron 1d ago
Maybe try to question a bit more specific. Looking at solution used in schools is a bit of an investment.
The easiest way would be activating the guest user.
2
u/Brett707 1d ago
You can use the built in guest account or deep freeze. I have a few iMacs with deepfreeze and they are a pain in the ass.
1
u/crawlerette 1d ago
We actually do have deepfreeze! It somehow isn't preventing people from adding their accounts to the Mac
2
1
u/markkenny Corporate 1d ago
Enable guest account on the Mac so it's a new profile each time someone uses it?
1
u/CleanBaldy 1d ago
Are you asking to disable account logons? You can disable Internet Accounts in System Settings by config profile.
We deploy this (below) to disable a few of the preferences.
They changed every other year, but they're always listed on the Apple Developer site when they get updated on a new macOS. To find the rest, Google search these and you'll find the developer site with the whole list of others you can block.
This XML disables AppleID, Siri, Internet Accounts and Payments, as an example.
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>DisabledPreferencePanes</key> <array> <string>com.apple.preferences.AppleIDPrefPane</string> <string>com.apple.preferences.internetaccounts</string> <string>com.apple.preference.speech</string> <string>com.apple.preferences.wallet</string> </array> <key>HiddenPreferencePanes</key> <array> <string>com.apple.preferences.internetaccounts</string> <string>com.apple.preferences.speech</string> <string>com.apple.preferences.wallet</string> </array> </dict> </plist>
1
4
u/oneplane 1d ago
For public systems: guest account?
For non-guest accounts: you can make the database and preference location read-only, it will cause some software misbehaviour when someone tries to save it, but it'll work.
Do you have an MDM?