Create a read only Mac user

Question

I have a set of MacBook Pros which students will be using. I want to create a user which automatically logs in and resets back to it's defaults next time they log back in. In Windows land I'd make a mandatory profile.

What's the best way to go about this?

Answer 1

You can create a LoginHook script to reset the user's home folder on every login. Mike Bombich has some example scripts, including one that simply resets an account every login, and one that resets but saves the old home folder to /tmp in case you need to recover previous work. You'll probably want to edit the script a bit to change which user(s) are affected (the first only resets if the account name is "student", the second for anything except "admin"), and maybe what it uses as a template for the reset account (by default, both use the standard system template, /System/Library/User Template/English.lproj -- you can customize this folder to taste, but it's also what gets used for newly created accounts, so you might want a separate template for the reset account). Be a bit careful with this script, as it'll run as root before each login session for ALL users -- if you get it too seriously wrong, it could wipe your account as well and/or keep you from logging in at all.

To enable the LoginHook, use

sudo defaults write com.apple.loginwindow LoginHook /path/to/loginhook/script

and then use the regular Accounts preferences to set automatic login to that account, and you should be set.

Answer 2

Deep Freeze would be perfect for this application.

• Allows passwords (guest does not)
• Allow full access to everything, including installing software / editing permissions / etc. (guest does not)
• Create a perfectly clean image that is restored when the computer is restarted. You don't have to worry about anything being left or broken. They run a sudo rm -rf /? Reboot and it is fixed. Installed a bunch of crap? Reboot and it's fixed.

Answer 3

You can use a Guest account. A Guest account allows a user to log in, but the guest's files are removed when he logs out. A Guest account can't have a password, though.