The Applications Properties settings allow you to control access to specific applications and paths to applications using digital signatures.
You can apply Application Properties settings under both Computer Configuration and User Configuration.
The Application tab settings control which applications are allowed to execute on Mac OS X and support the following management modes: Never, Always.
Application restrictions are controlled by means of folder paths. Group Policy does not currently support application management using digital signatures, therefore to allow or prevent users from launching an application, add the application or the path to the application to one of two lists:
Add folders containing applications that you want to prevent users from opening. All applications in sub-folders of disallowed applications are also disallowed.
Add folders containing applications that you want users to launch. If an application or path to the application appears in both the disallow and the allow lists, then the disallow list takes precedence and the user is not allowed to launch the application.
If an application does not appear in either of these lists, the user can not launch the application.
Click Add to open the New Application Item dialog. You can type the absolute Unix path or you can click Remote Browse to log into a remote Mac OS X machine (by means of SSH) and browse for the target folder. It displays recently specified paths. To reuse a recently specified path, double-click the item in the list.
Note: Both disallow and allow paths support the %HOME% macro-expansion to the user's Unix home directory. For example, to restrict a user from running applications in their home directory, specify %HOME%. This macros is only supported by user policies; machine policies do not support this macro type.
Front Row is media center software for Mac OS X. Front Row tab settings allow you to control whether or not Front Row is allowed to execute and supports the following management modes: Never, Always.
Select Allow Front Row, to allow Front Row to execute on Mac OS X.
Widgets tab settings allow you to configure which Dashboard widgets are allowed to execute on Mac OS X clients. By default Authentication Services enables a set of common Dashboard widgets for management. If you want to customize the set of available Dashboard widgets you can edit the widgets.xml file which is installed into the Authentication Services installation directory. Widgets settings supports the following management modes: Never, Always.
If you select the Allow only the following Dashboard widgets to run: option, only the listed widgets are allowed. Click Add and Remove to configure the set of allowed widgets.