Disable User Password Change Capability / Software Updates on managed devices

[chipchen]

Got a few questions... hoping for some suggestions:


Need to disable password changing

So I have a small number of "public" iMacs in an educational environment. I have them all with a managed user, "Student" with the password "student". The iMacs are there so students can log in and print, surf the web, etc... think computer lab or library computer.

Anyway, in previous versions of MacOS (like Lion), you could actually disallow users from changing their passwords. This option no longer exists under manage user options. Is there another way or a better practice? How do most people run computer labs nowadays?


Software updates on managed devices

I have other users where I've cloned Mac OS images onto them with all our software. However, because of this, software updates always want the Apple ID tied to each specific app. (We're talking about the free ones, not Mac App Store apps... all our software is paid for a licensed) So Pages, Numbers, Keynote... etc, they want an Apple ID. So far I've just been using a generic Apple ID. Is there a better way to do this?

 

[Geeky Chimp]

Are you using an MDM such as Profile Manager included in macOS Server?
Using Profile Manager you can prevent users from changing their passwords within the macOS - Security & Privacy Settings.
For the Software Updates, the iWork and iLife Apple Apps are now free. You can deploy them using an MDM such as Profile Manager, and assign the Apps directly to the device. The Apps can be 'purchased' using the Apple Volume Purchase Program (VPP).

 

[DJLC]

You definitely need an MDM solution. Profile Manager is one, although it requires that you have a macOS Server on-site and it's kind of terrible in my opinion. You could also look at Mosyle Manager, which is free for schools for one platform (so you could do macOS or iOS for free; not both). We're using Mosyle Manager Premium for both macOS and iOS.

At the same time, you should also get set up with Apple School Manager (ASM), the Device Enrollment Program (DEP), and the Volume Purchase Program (VPP). All three work together to ensure the MDM and any App Store installs work properly. For a free App Store app, our workflow would be something like: "purchase" X copies of the app from VPP, Mosyle picks up those licenses, then we create an App Install profile to install that app on student devices.

(Extraneous deets: ASM is your sort of portal to VPP and DEP. You can also use it to create student Apple IDs, although it doesn't sound like that step is necessary in your environment. Once you have ASM, that allows you to use DEP and VPP. DEP allows you to permanently tie devices to your MDM; so even if a Mac or iPad is factory reset, it gets re-enrolled with your MDM automatically no matter what during setup. This also allows hands-free configuration; for us, all I need to do to configure a Mac or iPad in our environment is take it out of the box, turn it on, and connect it to a network. And then VPP allows you to bulk purchase free or paid apps from the App Store.)