How to lock the Dock on a shared Mac

What actually goes wrong on a shared Mac

A Mac used by more than one person collects small changes. Someone brushes the divider and every icon is a different size. Someone drags an app out because they did not recognise it. Someone turns on auto-hide, or moves the Dock to the left, and nobody admits to it.

None of it is malicious and none of it is difficult to fix. It is just relentless, and on a machine at a front desk, in a classroom, or in a shop window it looks unmaintained.

The four locks

Set the Dock up exactly as you want it first, because these freeze whatever is in place when you run them. Then open Terminal and run the ones you need:

defaults write com.apple.dock size-immutable -bool true; killall Dock
defaults write com.apple.dock position-immutable -bool true; killall Dock
defaults write com.apple.dock contents-immutable -bool true; killall Dock
defaults write com.apple.dock autohide-immutable -bool true; killall Dock

Size stops the divider being dragged. Position keeps it on the edge you chose. Contents stops icons being dragged out, dropped in or rearranged. Auto-hide pins the hide and show setting.

The free command generator writes these out for whichever locks you pick. Swap true for false to release any of them. The matching controls in System Settings go grey while a lock is on, which worries people who find them later.

One thing worth knowing: the contents lock stops the Dock being edited. Apps that are running still appear in the temporary section to the right, and that is normal rather than the lock failing.

Why that is not enough for a truly shared machine

Those settings live in the user account that ran them. That means:

• They only apply to that account. A second user account has its own unlocked Dock.
• Anyone with Terminal can undo them. The undo is the same line with false, and it is the first result for anyone who searches.
• There is nothing to tell you they were undone. You find out weeks later when the Dock looks wrong again.

For a family Mac that is usually fine, since nobody is trying to defeat it. For a kiosk, a reception machine or a classroom, it is not a lock, it is a suggestion.

What Screen Time does and does not do

Screen Time, which replaced Parental Controls, is the usual suggestion for locking down a shared Mac. It is genuinely good at restricting which apps can run, blocking content, and limiting hours.

It does not manage the Dock. There is no Screen Time setting for Dock size, position or contents. If the problem you actually have is the Dock being rearranged, Screen Time is not the tool, and a lot of advice sends people there anyway.

Locks that survive being undone

The mechanism that genuinely holds on a shared machine is a configuration profile. It is the same thing companies and schools use to manage Macs at scale, and it outranks a user-level preference.

A profile keeps the Dock locked through Terminal commands, through a restart, and through the removal of whatever installed it. It is removed deliberately, in System Settings, General, Device Management, not accidentally.

Still Dock can install one per lock from its menu bar, without you writing any profile XML, and it is clear about the trade: profiles are the right answer for a Mac other people use, and the wrong answer for your own, where the ordinary locks undo in a click and never ask for a password.

A sensible setup for each case

• Family Mac. The four commands, or the switches. Nobody is fighting you, so undoability is a feature.
• Front desk or reception. Contents and position locked at minimum, since that is what visitors disturb. A profile if the machine is unattended.
• Shop or showroom display. All four, as a profile. It has to look identical every morning without anyone checking it.
• Classroom or lab. A profile, and if the Macs are already enrolled in an MDM, do it there instead so it is managed centrally.

Using more than one screen? The Dock also jumps between them, which is a separate problem with its own fixes: how to keep the Mac Dock on one screen.

Common questions

Do these locks apply to every user account?

No. A defaults write command applies to the account that ran it. Run it in each account, or use a configuration profile, which can apply to the whole machine.

Can someone undo the locks without Terminal?

Not through System Settings, since the controls are greyed out while a lock is on. But the Terminal undo is one line and easy to find, so treat these as protection against accidents rather than against someone determined.

Will locking the Dock stop apps being installed?

No. It only controls the Dock. For restricting what can be installed or run, use Screen Time or a managed device profile.

What happens if I remove the app that made the profile?

The profile stays and the Dock stays locked, which is the entire point. Remove it in System Settings, General, Device Management.

Is this the same as a work Mac managed by IT?

The mechanism is the same. The difference is that a managed Mac's profile is installed remotely and locked so you cannot remove it locally. One you install yourself, you can always remove.