With the help of glarizza’s module, Property_List_Key, I’m testing managing OS X plist with Puppet. This turns the built-in firewall on and ensures it stays on. Tested on OS X 10.9.5

 property_list_key { 'globalstate':
      ensure => present,
      path   => '/Library/Preferences/com.apple.alf.plist',
      key    => 'globalstate',
      value  => '1',
      value_type    => 'integer',
    }

This get’s me thinking all sorts of creative things that can be managed and enforced in a lab setting, where user’s might have admin rights and make undesirable changes.