disabling shut down on Apple menu

Sorry guys for digging up a tiny bit of an old post but I too was hunting around for ages until I began to actually learn something about osx server. I am using the latest lion manifold so I am unsure if the exact procedure will be the same for SL.

2 words, "Workgroup Manager".

The settings you are after sit in Preferences(either the icon at the top next to Accounts or view==>preferences next to file menu)==>Overview/Finder==>Commands.

I suggest creating groups to manage what you are about to do effectively and segregating admins from non admins as a root group and spanning from there.

GL!

I don't off-hand know how to disable the Apple menu options, but in your case this should not be necessary. Try the following.

• On the server open System Preferences, then select Energy Saver, then make sure the option to "Allow power button to put computer to sleep" is turned off.
• On the server open System Preferences, then select Accounts, then Login Options, then make sure the option to "Show the Restart, Sleep, and Shutdown buttons" is turned off.
• On the server open System Preferences, then select Security, then General, then make sure the option to "Require password" to wake from sleep or screen saver" is turned on.
• You could also consider not leaving the Server logged in. The Server does not need to be logged in for Apple's server software to run. However if your running some third-party software like 4-SightFax Server that does need the server to be logged in.
• Consider locating the server in a location mere users cannot access, e.g. a server room, or a locked server rack, or similar.

Doing all the above should prevent accidental shutdowns for nearly all situations.

Note: On a client computer selecting Shutdown will not shutdown the server.

There is one scenario where a user could potentially try shutting down the server but I don't think it applies to you (it does to me). We run a Terminal Server system on a Mac server which allows client computers to run applications on the server. In our case we are using this to allow Windows 7 computers to run a FileMaker system on the Mac server as it is using a lot of AppleScripts which do not work on Windows. The Windows computers connect to the Mac Terminal Server and see a Mac desktop from which they can launch FileMaker Pro. They also of course get the normal menus including the Apple menu and in that is - the Shutdown command.

gailfromallbiz wrote:

Hi John,

Sleep is OK but the "Show Sleep, Restart and Shut Down" buttons is OFF but doesn't affect the Apple Menuitems, only Login.

We are using the Mac Mini Server as a Terminal Server (we are porting sites from Windows Server TS/RDS environments where Group Policies are use to control issues such as I have raised). I have raised the point with Code Rebel (iRAPP) support, but the issue is quite serious. We have already had one tired user shut down instead of logging off - pandemonium the following day when the server was "dead".

Some integrators appear to use "on quit" scripts to control the behaviour with "warning warning extreme danger!" messages. I was really hoping that I had just missed something obvious ......

Ah! So you are using a Terminal Server like I am and I therefore fully understand your concern. I did mention that my tips did not modify the Apple menu but might help but not for Terminal Server scenarios.

However, what I have found helps for me, is that I deliberately leave an Administrator account permenantly locally logged in on the server acting as the Terminal Server. When (in your case) an iRAPP connected user mistakenly tries to shutdown the server even if they are the only connected iRAPP user they will now get a warning saying

There are currently logged in users who may lose unsaved changes if you shut down this computer.

Restarting or shutting down the computer will quit application in other sessions where documents have not been saved. The data will be lost. Enter an administrator's name and password and click Shut Down, or choose Cancel to dismiss.

As long as you do the proper thing of not giving mere users Administrator level accounts, they will not be able to force the shut down to continue. Works for me with iRAPP although I also suggested they find a better way to limit access.

gailfromallbiz wrote:

Hi John,

Thanks for your ideas. Two questions: one of my users is a "partial" administrator - will this stop the idea working? Also, how do I auto login my local admin account after reboot?

Regards

As long as more than one user is logged in the warning message should appear. If the user you refer to above has Administrator privileges on the server itself then they might be able to enter a valid name and password and force the shutdown but this at least is an extra step and warning that should prompt them to think.

In what way do you believe this user counts as an administrator? An Open Directory administrator would not count if that is what you are thinking off, only a local Administrator (on the server). A Open Directory user account can be made an Administrator for local purposes (on the server) but I cannot see any case that would need this.

gailfromallbiz wrote:

Partial Administration privilege as set up in Workgroup Manager - able to change other's passwords et al but not mainstream admin tasks. They are OD users and sysadm is local user so not same group. This is necessary as we support remotely and client has requested a degree of autonomy.

That sounds like it should not count as an administrator of the physical server so they would not be able to force a shutdown as long as another user (e.g. the local administrator account) is left logged in.