How to lock the Dock on a front desk or showroom Mac

The difference here is that people can see it

On a personal Mac a Dock at the wrong size is an irritation. On a front desk, a reception counter or a showroom demo unit, it is the first thing a customer looks at while they wait, and it is being read as a statement about how the place is run.

The failures are the ordinary ones, and they are ordinary because the machine is used by whoever is on shift:

• The size. The divider between apps and folders sits in the busiest part of the screen and is a drag handle. One brush and every icon changes. macOS has no undo for it.
• Auto-hide, switched on by accident. Now the Dock is invisible, and the next person on shift does not know to push into the edge. On an unattended machine it can sit like that for days.
• An icon dragged off. The app is still installed. The person covering reception on Saturday cannot find it.
• The position. Moved to a side edge, which changes the usable width of every window on a screen that may be showing a booking system all day.

The four keys

defaults write com.apple.dock size-immutable -bool true
defaults write com.apple.dock position-immutable -bool true
defaults write com.apple.dock contents-immutable -bool true
defaults write com.apple.dock autohide-immutable -bool true
killall Dock

Each grays out the matching control in System Settings, so it cannot be changed from the interface at all. They are per account, they survive a restart and a macOS update, and they are undone by removing the key rather than setting it to false:

defaults delete com.apple.dock autohide-immutable; killall Dock

Every key with its type is in every Mac Dock defaults command.

The second screen, which no command fixes

Reception desks and showrooms nearly always have a second display: a customer-facing panel, a wall screen, a demo monitor. And the Dock is not assigned to a screen. It follows the pointer. Push the cursor to the bottom edge of any display and hold it there, and the Dock moves to that one.

There is no defaults key for this and no setting in System Settings. It is what Apple designed the Dock to do, and it means a Dock full of internal tools can appear on the screen a customer is looking at, mid-conversation, because somebody reached for something.

The workarounds all cost you something: turning off “Displays have separate Spaces”, moving the Dock to a side edge, or changing which display is the main one. Each is explained with its cost in how to keep the Mac Dock on one screen. If none of those are acceptable on a desk that has to look right, an app that holds the Dock to one screen is the remaining option.

Staff turnover is the actual risk

A classroom has a teacher who set the room up and remembers. A library has a baseline image. A front desk has whoever is working today, and in a year that is a different person.

Which means the failure mode here is not a lock being undone. It is a lock nobody remembers setting. Somebody opens System Settings a year from now, finds the Dock controls grayed out with a note that they are managed, and has no idea who did it or why. That is a support ticket, and occasionally a wiped machine.

So the two things worth doing on a business Mac, beyond the locks themselves:

1. Write down what you set and where. In whatever the shop actually reads: the handover notes, the wiki, a label under the counter.
2. Prefer the removable version. There is a responsible person on site, so a lock that can be lifted deliberately is better than one that cannot be lifted at all.

Which mechanism suits a desk

• A defaults command. Fine when nobody at the desk opens Terminal, which on a front desk is most of the time. Free, and reversible in one line.
• A configuration profile installed by hand. Holds through Terminal, through a restart, and through deleting whatever created it. It applies to that login and is removed on purpose in System Settings, General, Device Management. For a business Mac with someone accountable for it, this is the right shape rather than a compromise.
• A profile pushed by an MDM. Right if the company already manages its Macs centrally. Overkill for one machine on a counter.

All three compared, with what each costs: how to lock the Dock on a Mac, 3 ways compared.

Recent apps, on a Mac a customer can see

macOS adds a section of recently used applications to the right of the Dock. On a customer-facing screen it shows whatever the last member of staff opened. Turn it off:

defaults write com.apple.dock show-recents -bool false
killall Dock

The four locks do not remove it. It is a separate setting, covered in how to stop recent apps appearing in the Dock.

A sensible setup for a front desk

1. Arrange the Dock as the desk should have it, and take off anything a customer does not need to see.
2. Turn off recent apps.
3. Apply all four locks.
4. Decide what happens on the second screen, because that is the one the locks do not cover.
5. Write it down where the next person will find it.

Common questions

Will the locks stop the Dock moving to the customer screen?

No. position-immutable stops the Dock being moved to a different edge of a screen. It has nothing to say about which screen the Dock is on, because macOS provides no setting for that at all.

Do I need this if the Mac is only used by staff?

That depends on how many staff and how many shifts. One person at one desk rarely needs it. A counter used by six people over three shifts is where the Dock drifts fastest, because no single person notices the change.

Will a macOS update clear the locks?

No. They live in the account’s preferences rather than in the system, so an update leaves them alone.

What if the machine is a demo unit customers touch?

Then the customer is using it rather than looking at it, and the reasoning changes. See locking the Dock on a shop or showroom Mac.

Is this the same as a classroom Mac?

The commands are. The situation is not: a classroom has accounts and supervision, and a student who can open Terminal. See locking the Dock on a classroom Mac, on a family Mac, or the shared Mac guide for the general case.