User Configuration > Policies > Centrify Settings > Mac OS X Settings > Application Access Settings > Permit/prohibit access to applications
Allow other policies to specify the applications that users are permitted to access or prohibited from accessing. You must enable this policy for any other application access group policies to take effect. Once enabled, only the applications explicitly specified in Application List policies are permitted or prohibited.
If you enable this policy, in Access mode, select one of the following:
- Users can only open these applications to grant access only to the applications you select with the other application access policies.
Note: If you select the option: “User can also open all applications on local volumes” users can access any local applications. Restrictions only apply to applications on CDs, DVDs, or external disks.
Users can open all applications except these to prevent access only to the applications you select with the other application access policies.
You can also set the following options in this group policy:
- Select User can also open all applications on local volumes to allow access to applications on a computer’s local hard drive.
If selected, users can access any local applications in addition to the applications explicitly approved using the other application access policies. If you uncheck this option, users can only access applications on CDs, DVDs, or external disks that have been explicitly approved.
Select Allow approved applications to launch non-approved applications to allow approved applications to open applications that aren't explicitly approved.
For example, if users click a link in an email message, this option allows the email application to open a browser to display the Web page even if the browser is not listed as an approved application. To prevent approved applications from opening applications that aren’t explicitly approved, uncheck this option.
Select Allow UNIX tools to run to allow applications or the operating system to run tools, such as the QuickTime Image Converter, without explicitly listing them as approved applications.
These tools usually operate in the background, but can be run from the command line. If you want to prevent access to these tools, do not check this option.
Once enabled, this group policy takes effect dynamically at the next group policy refresh interval.