ÂIf you don’t manage the Applications pane, Legacy settings take effect for any version of Mac OS X.
ÂIf your users run Mac OS X v10.4 or earlier, only Legacy settings take effect.
You can also use settings in Applications preferences to allow only specific widgets in Dashboard or to disable Front Row.
The table below describes what the settings in each Applications pane can do.
Applications preference pane | What you can control |
Applications | Access to specific applications and paths to applications using |
| digital signatures (for users of Mac OS X v10.5 or later) |
|
|
Widgets | List of allowed Dashboard widgets for users of Mac OS X v10.5 |
|
|
Front Row | Whether Front Row is allowed |
|
|
Legacy | Access to specific applications and paths to applications using |
| bundle IDs (primarily for users of Mac OS X v10.4 or earlier) |
|
|
Controlling User Access to Specific Applications and Folders
You can use Workgroup Manager to prevent users from launching unapproved applications or applications located in unapproved folders.
In Mac OS X v10.4 or earlier, applications were identified by their bundle IDs. If your users have Mac OS X v10.5 or later installed, you can use digital signatures to identify applications. Digital signatures are much more difficult to circumvent than a bundle ID.
Workgroup Manager can sign applications that aren’t already signed. When signing an application, you can embed a signature or you can store a detached signature separate from the application.
Embedding a signature has several performance benefits over a detached signature, but with signature embedding you must make sure every computer has the same signed application. For applications that are run from a CD, DVD, or other
Workgroup Manager uses the following icons to denote the kind of signature associated with an application.
Icon | Indicates the application has this type of signature |
(no icon) | Embedded signature |
|
|
| Detached signature |
|
|
| No signature |
|
|
Chapter 10 Managing Preferences
165
