I want to know if there is a way to prevent users (even administrators) to change a network parameter (dns domain for exemple).

Not simply "lock" the parameters and be allowed to unlock them with a password to change them, I want something like the GPO on windows that disables totaly any possibility to change the network settings except if the local policy itself changes to re allow it.


Get the latest OS X Server.app. Enable all appropriate services. One important service is the Open Directory Service.

Then enable and configure the Profile Manager. With the Profile Manager you can set up OS X and iOS devices. Beyond a lot of other features you can also restrict access to all System Preferences items.

Completely explaining the set up and the configuration would be beyond the scope of an answer. Please check Apple documentation or a walk-through like this one.

With additional tools like ADmitMac and a Windows AD environment you can also use Windows GPOs.


It's hard to say. There are certainly third party management products that leverage config profiles etc. to lock down options. But it's very difficult to stop that via the command line if there are admins.

For example, I suppose you could set a launchagent to watch specific network plist files, and do something if they're changed. You would also have to think about cached preferences (cfprefsd and all). However it may prove inadvisable to interfere with the normal operation of the OS.

(Administratively speaking, messing up a network config and losing communication with all your machines would be a nightmare. :)

You may also want to consider achieving your goals by other means. If you're having issues with people changing DNS entries, you could simply schedule a script to run every day that reverts DNS.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .