All versions of Centrify DirectControl on Mac OS XQuestion:
Is it possible to restrict users from downloading new apps from the App Store, but still allow them to download updates to existing apps?Answer:
The Mac App Store has a setting called "Software-Update Mode". When this setting is enabled, users will only have access to the Updates section, all other sections will be disabled.
There are three possible methods to applying this setting:Option 1: To apply the restriction system-wide:
Option 2: To apply the restriction to specific users only:
- Configure the following GP:
- Computer Configuration / Centrify Settings / Common UNIX Settings / "Specify commands to run"
- Add the following command:
- sudo defaults write /Library/Preferences/com.apple.appstore restrict-store-softwareupdate-only -bool yes
Option 3: Via a mobileconfig configuration profile:
- Place this command into a login script:
- defaults write com.apple.appstore restrict-store-softwareupdate-only -bool yes
- Set up the script to be run from the following GP:
- User Configuration / Centrify Settings / Mac OS X Settings / Scripts / "Specify multiple login scripts"
- Attached is an Apple Configuration Profile which can also be used to manage the setting in the App Store.
- Login to the Mac as Local Admin and download the mobileconfig to the Desktop
- Open the Terminal and run the command:
- sudo profiles -I -F "~/Desktop/RestrictAppStore.mobileconfig"
- Logout and login as an AD user
- Open the App Store and the user should now only have access to the Updates section.
- The mobileconfig will be installed as a "Device Profile"
- To deploy this configuration profile via group policy, see the following KB:
- For further information on these configurations (including how to reverse the setting), please see the Apple KB:
- For an example of how to set up a simple command within a login script, see the following KB:
- It has been noticed that the Terminal commands described in Options 1 & 2 and from the Apple KB may no longer work for OS X 10.9 Mavericks and higher.
- In these situations, Option 3 should still continue to work with no issue.
(All external links provided as a courtes)