The use of the defaults command in Mac OS X is something of a black art. For one thing, you need to delve into property lists to determine what property you want to change.
Therefore, I didn’t want to resort to it to set Safari’s “open safe downloads” preference, but it looks like that particular setting is regrettably not one that you can control with Workgroup Manager (or the Apple MCX schema for managed clients).
So, to make that settings change at the command line or through a script, you can use the following tips. (If you have to do something much more advanced with plists than this, you may want to consider using PlistBuddy, a propertly list manipulation tool which Apple includes in their installers.)
With defaults read, you can read the AutoOpenSafeDownloads property in the user’s domain:
% defaults read com.apple.Safari AutoOpenSafeDownloads
That will return 0 or 1, the former meaning the “off” or “no” and the latter meaning “on” or “yes.”
To turn AutoOpenSafeDownloads off, use the defaults write command with the -bool option at the command prompt:
% defaults write com.apple.Safari AutoOpenSafeDownloads -bool NO
To turn it on, change the boolean option to YES:
% defaults write com.apple.Safari AutoOpenSafeDownloads -bool YES