How to lock the Dock on a classroom Mac

What students actually change

In a room of Macs the Dock is the first thing to drift, and it is nearly always one of four things:

• The size. The divider between apps and folders is a drag handle in the busiest part of the screen. One brush and every icon changes size. macOS has no undo for it, so the next class finds a Dock nobody chose.
• The contents. An icon dragged off the Dock vanishes in a puff. On a shared machine the app is still installed, but the student in period three cannot find it.
• The position. Dragged to the left or right edge, which changes the usable width of every window on the screen.
• Hide and show. Switched on by accident, and now the Dock is invisible to a student who does not know to push into the edge.

None of this is misbehaviour. It is what happens when thirty people use a machine designed for one.

The four keys

Each of these makes the matching control in System Settings stop responding, so the setting cannot be changed from the interface at all:

defaults write com.apple.dock size-immutable -bool true
defaults write com.apple.dock position-immutable -bool true
defaults write com.apple.dock contents-immutable -bool true
defaults write com.apple.dock autohide-immutable -bool true
killall Dock

They are per user, so they apply to the account you run them in. They survive a restart, a sleep and a macOS update, because they live in the user's preferences rather than in the system.

To release one, remove the key rather than setting it to false, which puts the setting back to whatever macOS does by default:

defaults delete com.apple.dock contents-immutable; killall Dock

The full list with every key's type is in every Mac Dock defaults command.

Why that is not enough in a lab

Anything a Terminal command sets, a Terminal command undoes. A student who can open Terminal can lift all four locks in under a minute, and in a computing class that is most of them.

It also does nothing about a fresh account. Run the commands in one login and the student who logs in next gets a default Dock, because preferences are per user.

What a configuration profile changes

The same four settings delivered as a configuration profile are enforced by macOS rather than stored as a preference. That means they survive Terminal, they survive a restart, and they survive the app that set them being deleted.

Scope is the part that decides whether a profile suits a lab. A profile pushed by an MDM can be scoped to the device, so it covers every account including new ones. A profile a person installs themselves is scoped to that user, so it covers that one login. Still Dock installs the second kind, and it is deliberately removable in System Settings, General, Device Management, because nobody should be left with a Dock they cannot unlock.

This is the right tool for a Mac a school owns and the wrong tool for a Mac a teacher owns personally, because undoing it is an administrative act rather than a click.

So if the room is managed by an MDM, the Dock payload is where this belongs, alongside whatever layout you already push, and it is the only version of this that a determined student cannot lift. If it is a handful of machines set up by hand, Still Dock can install one profile per lock from its menu bar, per login, which is enough to stop the accidents and not enough to stop somebody who goes looking.

Recent apps, the other thing that changes a lab Dock

Even with the four locks on, macOS adds a section of recently used applications to the right of the Dock, and it changes with every student. Turning it off is a separate setting:

defaults write com.apple.dock show-recents -bool false; killall Dock

That one can also be delivered by profile so it cannot be switched back on, which is covered in how to stop recent apps appearing in the Dock.

What Screen Time will not do

Screen Time restricts which apps can be opened and for how long. It has nothing to say about the Dock's size, position, contents or auto-hide, so it is not an alternative here. The two solve different problems and are fine together.

A sensible setup for a classroom

1. Arrange the Dock exactly as the room should have it, including removing anything students do not need.
2. Turn off recent apps, so the right-hand section stops changing.
3. Apply all four locks.
4. If students have Terminal, deliver those locks by configuration profile instead of by command, or they will not last the term.
5. Write down what you set. A lock with no record is a mystery for whoever inherits the room.

Common questions

Do the locks apply to every student account?

Not when set with defaults. Those are per user, so each account needs them. A device-scoped profile from an MDM does cover every account, which is usually what a lab wants. A profile installed by hand, including the ones Still Dock makes, applies to the login that installed it.

Will a macOS update clear them?

No. They live in the user's preferences, not in the system, so an update leaves them alone.

Can a student undo them?

With defaults, yes, in one command. With a profile installed by hand, they can still remove it in System Settings, General, Device Management, but not by accident and not from Terminal. Only an MDM-installed profile can be made genuinely unremovable, and that is a decision for whoever manages the room, not for an app.

Does this stop students installing apps?

No. It stops the Dock changing. Restricting installation is a separate matter, and Screen Time or your MDM is where that belongs.

What about a library or public computer?

Same four keys, different situation: nobody reports the drift, and the machine often restores to an image that would undo your locks. See locking the Dock on a library or public Mac, and on a family Mac for the same problem at home.