Today, I noticed that there were several "login items" that I'm 99.99999% certain I did not add. I figure those items added themselves when I installed them (they were probably installations that required authentication).
Of course, I can always check "login items" every time that I install an app (if the installer asked for authentication), but I'd prefer to lock "login items" altogether. Is that possible?
Best Answer
Update*
if you do a get info on the ~/Library/Preferences/com.apple.loginitems.plist file and tick the lock checkbox.
No changes will be written to the file. Therefor on next login there will be no additions.
I just tested this and it worked. But cannot guarantee that this may or may not be a good thing to do. I my self will use my Answer below.
You can set a launchAgent to watch for changes on the ~/Library/Preferences/com.apple.loginitems.plist file
In my example here I use a launchAgent to watch for the change and then run a command to notify me. In this case I use the command tool growlnotify
I actually made this using lingon which take some of the pain out of making launchAgent.
The command I run is :
/usr/local/bin/growlnotify -n "login items change" -m "login items have been changed" -s
Note this is a simple example. And you should remember that any changes may take a short while to be written to the plist. But my tests have shown it to work.