For all those OS X Administrators out there, keeping large numbers of Macs together can be tricky. Fortunately, over the years Apple has consistently improved it’s Mac Management application, Workgroup Manager, and it’s quite powerful. Here are seven little tricks that Workgroup Manager can do to make OS X administration easier.

The Managed Client App:
Before we get into the tricks, you’ll have to add in some extra features to Workgroup Manager. Why these aren’t included to begin with is beyond me.. but alas, it’s easy once you know what to do.
- Start up Workgroup Manager.
- Click on the Preferences tab.
- To the right, click on the Details tab.
- At the bottom, click the Plus button.

- Navigate to /System/Library/CoreServices.
- Select ManagedClient.app and click Add.

Now we can get into the advanced features Workgroup Manager offers.

1. Set the Desktop Picture:
While this won’t stop a user from changing the desktop picture, a quick logout and login will reset it back to what you want it to be. This is most useful in computer labs and other implementations where you want a uniform look.
- From the Detail pane, click Desktop Picture.
- Click the Pen button towards the bottom.
- Click to highlight the Often line.
- Click the New Key button at the top.
- Click the “New Item” key that appeared and choose “Background”

- Expand all the triangles until you reach the end.
- At the “Image Path” key, type in the exact file path to your preferred desktop image.

2. Controlling iTunes:
With this Workgroup Manager Trick, you can allow iTunes but restrict potential sources of network and liability problems. By managing some of iTunes functions – iTunes Store, Radio, Podcasts and Content Ratings you can customize iTunes to be usable for your environment.
- From the Detail pane, click iTunes.
- Click the Pen button towards the bottom.
- Click to highlight the Always line.
- Click the New Key button at the top.
- Set whichever keys you need for your situation.

3. Disabling Dashboard:
Dashboard.. How I loathe thee. Well that’s just my opinion, you may find that it’s little resource sucking gizmos, widgets, and doo-dads to be just lovely. But in a managed environment, Dashboard could be a source of unwanted apps, security risks and stability issues. So if you want to altogether shut it off, Workgroup Manager can do that too.
- From the Detail pane, click Dashboard.
- Click the Pen button towards the bottom.
- Click to highlight the Always line.
- Click the New Key button at the top.
- Click the new key and select “Disable Dashboard”.
- Change the value from false to true.

4. VPN Settings:
Need to make sure a large deployment can VPN into your network without a gigantic hassle? If you use OS X’s built in VPN client, send out those settings via Workgroup Manager!
- From the Detail pane, click VPN Settings.
- Click the Pen button towards the bottom.
- Click to highlight the Always line.
- Click the New Key button at the top.
- Select and set the appropriate keys for your network.

5. Set Home Page:
Setting a Home Page is a nice touch in labs. Or maybe your homepage is the key to logging in to the computer. Or maybe you’d like to prevent someone from setting a malware infested page, phishing site or otherwise inappropriate website as your lab’s homepage. Workgroup Manager can do this and more:
- From the Detail pane, click Internet Configuration.
- Click the Pen button towards the bottom.
- Click to highlight the Always line.
- Click the New Key button at the top.
- Select and set the appropriate keys.

While you are setting the Home Page, you can also set the default browser, email application and download location.

6. Turn on/off screen locking:
The Screen Locking feature is good for personal laptops but if you run a lab where everyone gets the same generic “user” login, this can be annoying. So, to turn it on for personal laptops but off in labs, here is what to set in Workgroup Manager.
- From the Detail pane, click Screen Saver.
- Click the Pen button towards the bottom.
- Click to highlight the Always line.
- Click the New Key button at the top.
- Click on the new key and select “Require Password”.
- Set the value to true for on and false for off.

7. Disabling Unwanted Applications:
In a computer lab, it’s essential to manage what can be run and what can not. This isn’t about being a fascist. It’s about keeping someone from uploading and running malware in your lab. In the case of schools, it may be to prevent children from using your lab for what they want (games) when they should be doing something else (work).
- In Workgroup Manager, click the Overview tab.
- Click the Applications icon.
- Select “Always” in the Manage: section.
- Check the “Restrict which applications are allowed to launch” checkbox.

- Click the “Folders” tab.
- In the first area, select Applications you want to disable.
- In the second area, select Application folders you want to allow.

Note: As a rule, if you are going to manage applications, ALWAYS disallow the /Users/ folders. This will prevent the downloading and launching of apps on the desktop. I’d also recommend disabling .DMGs from being opened to prevent apps running off USB drives. That’s done in the “Media Access” section, under the “Other Media” tab.

Wait, there’s more:
While the ManagedClient.app adds in some extra advanced features to Workgroup Manager, you can actually use Workgroup Manager to manipulate any .plist file in a managed machine.
For any Application that uses .plists for preferences, they can be added in and tweaked via the details pane. If you aren’t sure how the .plist should look, just set the application the way you want and copy the appropriate .plist file in.