OS X (Apple)

I understand how to lock down things with the finder in workgroup manager, but for matching commands outside of the workgroup manager realm, what's the best way to insert script in order to disable any one of these features?

Features workgroup manager highlights:

-connect to server
-shut down
-restart
-go to folder
-burn disc
-eject
-go to idisk
-burn disc

I'd like to push out a script command via ssh with the ability to disable which is the focus.

Take server tools and install them on an unbound machine. Use WGM to connect to the local directory services. Configure your desired settings for that local user account. Export that mcx file for that user via dscl command. You can then script a set of commands to import that MCX file and apply the settings to non bound machines.

Directory Services is almost near identical on the local machine as it is in Open Directory.

I'll begin testing this, but the complexity lies in deploying it under Aquaconnect's ability to allow deployment of the settings per user that authenticates within their terminal session. The key is to prevent individual users from shutting down the server or rebooting the server (since there's no golden triangle setup, with an OD server in place).

Presumably, Aquaconnect spawns multiple user sessions via some display functionality, but the actual user session on the server is still identical to a single user logon at the physical server. no?

That is, a new user logging on to the server via Aquaconnect, still automagically gets a "default" home folder on that server, created in /Users/

If that is the case, then any admin user can modify the /System/Library/User\ Template/<language>.proj/Library/Preferences/ directory. That takes care of any new user accounts that are created on the server for remote sessions.
Then you can copy the MCX file to existing user's home folders on the server and change privs for that preference file as needed via a script 'er something?

As I recall, Aquaconnect was positioned as the Mac equivalent to RDC on the PC. If that is the case, then user sessions are spawned on the server

look at the dscl command. Specially the mcx commands. You can read/export/import from here making it very plausible to script in your own management at either machine, group, or user level.