I've recently had to setup some computers for a school with the same kind of requirements. Of course there will always be ways around everything... but I went through and created a single account for all end users, limited its access in the accounts control panel, checked the unix permissions in key areas, and installed deep freeze.
Deep freeze is an app which basically takes a snapshot of the HDD, monitors any changes, and reverts them at reboot. So... if the computer DOES get messed with, you can just tell the (usually non-technical) attendants to simply reboot and the machine gets sent back to it's pristine state.
Check out:
http://www.faronics.com/
http://www.faronics.com/doc/DeepFreezeMacOSX.pdf
Slashdot Mirror
I've recently had to setup some computers for a school with the same kind of requirements. Of course there will always be ways around everything... but I went through and created a single account for all end users, limited its access in the accounts control panel, checked the unix permissions in key areas, and installed deep freeze. Deep freeze is an app which basically takes a snapshot of the HDD, monitors any changes, and reverts them at reboot. So... if the computer DOES get messed with, you can just tell the (usually non-technical) attendants to simply reboot and the machine gets sent back to it's pristine state. Check out: http://www.faronics.com/ http://www.faronics.com/doc/DeepFreezeMacOSX.pdf