How to lock the Dock on a library or public Mac

A public Mac fails differently

A classroom Mac has thirty people who can be told not to do something. A library or walk-up Mac has none of that, and it changes what you are actually defending against.

• Nobody reports it. A student says the Dock looks wrong. A member of the public who finds a Dock at half size assumes that is how the computer is, uses it anyway, and leaves. The drift accumulates in silence for months.
• The Dock is the entire interface. Someone who has never used a Mac has no Launchpad habit, no Spotlight habit and no idea what the menu bar is for. If the app they need has been dragged off the Dock, it does not exist.
• Sessions are short and anonymous. Nobody is invested enough to put it back, and nobody is identifiable enough to ask.
• It is almost never malice. It is a hand resting on the divider, an icon dragged two pixels too far, a stray pinch on the trackpad.

The one place a public Mac is easier

Public machines usually run a single account that is logged in permanently and never signs out. That makes the ordinary defaults route more durable here than in a classroom with per-student logins, because there is only one account for the settings to live in.

defaults write com.apple.dock size-immutable -bool true
defaults write com.apple.dock position-immutable -bool true
defaults write com.apple.dock contents-immutable -bool true
defaults write com.apple.dock autohide-immutable -bool true
killall Dock

Each one grays out the matching control in System Settings, so it cannot be changed from the interface at all. They survive a restart, a sleep and a macOS update. The full list with every key’s type is in every Mac Dock defaults command.

The recent apps section, which is a privacy problem here

macOS adds a section of recently used applications to the right of the Dock. On your own Mac it is a convenience. On a walk-up Mac it is a list of what the previous person opened, shown to the next person who sits down.

defaults write com.apple.dock show-recents -bool false
killall Dock

The four locks above do not remove it, because it is a separate setting. Turn it off deliberately. More on it in how to stop recent apps appearing in the Dock.

The restore image trap

Many public Macs are set to return to a known state, either through imaging software or by restoring a disk snapshot on reboot. That is the right way to run a machine like this, and it has one consequence people meet the hard way:

Anything you configure after the baseline was captured is undone the next time the machine restores. Your Dock locks are configuration. Set them, confirm them, and only then capture the image. If the Mac is already in service, the change belongs in the baseline, not in the running session, or you will be setting it again every morning and wondering why.

The same applies to the recent apps setting and to the Dock’s actual contents. Arrange the Dock exactly as the public should find it, then capture.

Who can undo what

Worth being precise, because the three mechanisms are not interchangeable.

• A defaults command is undone by another defaults command. Anyone who can open Terminal can lift all four in a minute.
• A configuration profile you install by hand holds through Terminal, through a restart, and through deleting whatever created it. It applies to the login that installed it, and it can still be removed on purpose in System Settings, General, Device Management. That is deliberate: nobody should be left with a Dock they cannot unlock.
• A configuration profile pushed by an MDM is the only version that can be made genuinely unremovable and scoped to every account on the device. If the library already manages these Macs centrally, that is where this belongs.

For a public machine with no Terminal access in the hands of the public, the ordinary locks are usually enough. For one where Terminal is reachable, they are not.

A sensible setup for a walk-up Mac

1. Arrange the Dock exactly as the public should find it, and remove anything they do not need.
2. Turn off recent apps, so the section stops reporting the last person’s work.
3. Apply all four locks.
4. If Terminal is reachable, deliver the locks by configuration profile rather than by command.
5. Capture the restore image now, not before.
6. Write down what you set, and where. A lock with no record is a mystery for whoever inherits the machine.

Common questions

Does this stop someone opening apps they should not?

No. It stops the Dock changing. Restricting which apps can run is a separate matter, and Screen Time or your management tool is where that belongs. The two are fine together and solve different problems.

The Mac wipes itself on reboot anyway. Do I still need this?

Only if the reboot happens often enough. A machine that restores nightly still spends a full day drifting, and the drift is worst in the afternoon when the most people have used it.

Will the locks survive a macOS update?

Yes. They live in the account’s preferences rather than in the system, so an update leaves them alone. A restore image, on the other hand, will replace them with whatever the baseline holds.

What if there is a separate guest or visitor account?

Preferences are stored per account, so anything set in one login does not appear in another. Set the locks in the account the public actually uses. If that account is one macOS clears between sessions, the settings will go with it, and the answer is a device-scoped profile from a management tool rather than a command.

Is this different from a classroom or a front desk Mac?

The commands are identical. The situations are not: a classroom has accounts, supervision and someone to tell, and a front desk has a second screen a customer can see. See locking the Dock on a classroom Mac, on a front desk or showroom Mac, on a family Mac, or the shared Mac guide for the general case.