166
Applications that include helper applications are denoted by a disclosure triangle. When you click the disclosure triangle, you’ll see a list of helper applications. By default, these helper applications are allowed to open.
You can disable individual helper applications, but the application may behave erratically if it requires the helper applications.
To allow or prevent users from launching an application, add the application or application path to one of three lists:
ÂAlways allow these applications. Add applications that should always be allowed, regardless of their inclusion in other lists. You can sign applications added to this list. Don’t add unsigned applications to this list because they allow users to disguise unapproved applications as approved applications.
ÂDisallow applications within these folders. Add applications and folders containing applications you want to prevent users from opening. All applications in the subfolders of a disallowed folder are also disallowed. Disallowing a folder within an application package can cause the application to behave erratically or fail to load.
ÂAllow applications within these folders. Add applications and folders containing applications you want to allow. All applications in the subfolders of an allowed folder are also allowed. Unlike applications in the “Always allow these applications” list, applications listed here are not allowed if they or their paths are listed in the “Disallow applications within these folders” list.
If an application or its folder doesn’t appear in these lists, the user can’t open the application.
Note: Some applications don’t fully support signatures. To make sure a signed application is properly restricted, make a copy of the application, sign it, and move it to a location in the “Disallow applications within these folders” list (when you try to open the application on a managed computer, it should open because the signature is valid). Next, void the signed application’s signature by copying a file into its application package. Now when you try to open the application on a managed computer, it should not open because the signature is void and the application is in a disallowed folder.
To allow users to open specific applications and folders:
1In Workgroup Manager, click Preferences.
2Make sure the correct directory is selected and you are authenticated.
To switch directories, click the globe icon. If you are not authenticated, click the lock and enter the name and password of a directory domain administrator.
3Select one or more users, groups, computers, or computer groups.
4Click Applications and then click the Applications tab.
5Set the management setting to Always.
Chapter 10 Managing Preferences
