Running applications from a disk image

The Applications folder and applications are supposed to be owned by the system user and members of the admin group. This excludes users. Are you endowing user accounts with admin privileges? They should be configured as managed accounts with privileges set under Parental Controls. They should not have access to System Preferences or to the Terminal application so they cannot alter file privileges.

Applications not installed as part of OS X may not have the right privileges for the Applications folder. Apps installed via drag and drop, for example, may have privileges giving users complete access. This can be fixed by logging into the admin account, opening the Terminal application in the Utilities folder and running the following command:

sudo chown -R root:admin /Applications

Press RETURN. You will be prompted for the admin password which will not be echoed.

As Kappy suggests, set things up in Parental Controls so people only have access to applications/features they need. If you can stop DiskImageMounter from being accessible then they won't be able to mount images.

Downloaded disc images usually end up without privileges that would prevent users from copying the files to a flash drive. However, any application that happens to come on a disc image file can be run from the mounted image. However, Skype and Filezilla are freeware/shareware and can be downloaded by anyone. You need to prevent users from having the ability to download such files or to use them improperly on the network. The only way to do that is through Parental Controls or to use third-party software like KidsGoGoGo that can be setup to control user access.