How to keep apps from adding themselves to login items? Today, I noticed that there were several "login items" that I'm 99.99999% certain I did not add.  I figure those items added themselves when I installed them (they were probably installations that required authentication).

Of course, I can always check "login items" every time that I install an app (if the installer asked for authentication), but I'd prefer to lock "login items" altogether.  Is that possible?
Update*

if you do a get info on the ~/Library/Preferences/com.apple.loginitems.plist file and tick the lock checkbox. 



No changes will be written to the file. Therefor on next login there will be no additions.

I just tested this and it worked. But cannot guarantee that this may or may not be a good thing to do.  I my self will use my Answer below.



You can set a launchAgent to watch for changes on the ~/Library/Preferences/com.apple.loginitems.plist file

In my example here I use a launchAgent to watch for the change and then run a command to notify me. In this case I use the command tool growlnotify

&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
&lt;plist version="1.0"&gt;
&lt;dict&gt;
    &lt;key&gt;Label&lt;/key&gt;
    &lt;string&gt;loginItems&lt;/string&gt;
    &lt;key&gt;ProgramArguments&lt;/key&gt;
    &lt;array&gt;
        &lt;string&gt;/usr/local/bin/growlnotify&lt;/string&gt;
        &lt;string&gt;-n&lt;/string&gt;
        &lt;string&gt;login items change&lt;/string&gt;
        &lt;string&gt;-m&lt;/string&gt;
        &lt;string&gt;login items change&lt;/string&gt;
        &lt;string&gt;-s&lt;/string&gt;
    &lt;/array&gt;
    &lt;key&gt;WatchPaths&lt;/key&gt;
    &lt;array&gt;
        &lt;string&gt;/Users/USERNAME/Library/Preferences/com.apple.loginitems.plist&lt;/string&gt;
    &lt;/array&gt;
&lt;/dict&gt;
&lt;/plist&gt;


I actually made this using lingon which take some of the pain out of making launchAgent.

The command I run is :/usr/local/bin/growlnotify -n "login items change" -m "login items have been changed" -s

Note this is a simple example. And you should remember that any changes may take a short while to be written to the plist. But my tests have shown it to work.