@Billski Thanks for this!
So far in my testing just running the @mm2270 script is working great with a few modifications. I'm having this script run after a few scripts I have happening during the users 1st login (opening various apps and pre-populating their user name/email addresses). I also added the marketing model name, and serial number to this as well. Since I only need this to run once per users computer, I have it run during that initial login, then keep the file there since the EA runs a cat of the text file at the next inventory update and then attaches it to the record. (If it doesn't find the file, it leaves the field blank). The EA then adds it to the JSS record in the Users and Location tab, which seems like a good enough place to look up that they signed off on this.
After trialing this out a few times, I think it will be perfect for newly imaged staff devices. I may push the policy to run the script out to staff who already have their computer too just to get everyone in compliance.
Thanks all for your help. Attached is my modified version if anyone else wants to use it.
#!/bin/bash
## Put full path to coocoaDialog here, wherever you deploy it to systems. Note the path all the way to the executable inside "MacOS"
CDPATH="/Users/Shared/cocoaDialogNew.app/Contents/MacOS/cocoaDialog"
## Capture the logged in user short name
loggedInUser=$( ls -l /dev/console | awk '{print $3}' )
## Get the full user name from dscl, if applicable for your environment (may need adjustment; test this separately)
fullName=$( dscl . read /Users/$loggedInUser RealName | awk -F, '{getline; print $2$1}' | sed 's/^ *//' )
## Get the computer name
compName=$( scutil --get ComputerName )
## Get the computer Serial Number
serialNumber=$( ioreg -c IOPlatformExpertDevice -d 2 | awk -F" '/IOPlatformSerialNumber/{print $(NF-1)}' )
## Get the computer model
model=$(curl -s https://support-sp.apple.com/sp/product?cc=$(
system_profiler SPHardwareDataType
| awk '/Serial/ {print $4}'
| cut -c 9-
) | sed 's|.*<configCode>(.*)</configCode>.*|1|')
## Path to EULA file with data on disk
eulaFILE="/private/var/eula_agreement"
## Edit this text below. Note that you may need to adjust the --height integer in the cocoaDialog call to accommodate longer text
MsgText="Below is Your Company's Acceptable Use Policy.
Please read it carefully, then check the "I agree to these terms" checkbox below, and finally click "OK".
Your AUP Here"
## Main script starts here
## See who's logged in. If its not "root" we aren't sitting at the login screen.
if [[ "$loggedInUser" != "root" ]]; then
echo "A user is logged in"
## Check to see if a eula_agreement file is already on disk, just in case it ran already
if [[ ! -e "$eulaFILE" ]]; then
echo "No previous eula_agreement file found on disk. Continuing..."
# Display the dialog. Notes:
# 1. The "--value-required" flag forces them to check the checkbox before the dialog can be dismissed.
# 2. If you want a custom icon, use --icon-file instead of --icon below and enter the full path to the icon file (icns, png, jpg, etc)
# 3. Adjustment of the --width and --height integers may be necessary. Occasionally CD doesn't rescale correctly based on the text.
# 4. Enter a title after --title if you want the dialog to have one. Use "" to use a blank title
EULADialog=$( "$CDPATH" checkbox --title "Acceptable Use Policy" --label "$MsgText"
--items "I agree to these terms" --button1 " OK " --value-required
--icon-file "/Library/Desktop Pictures/PPSLogo.jpg" info --width 800 --height 950 )
## Now detect the response.
if [[ $( echo "$EULADialog" | awk 'NR>1{print $0}' ) == "1" ]]; then
echo "The dialog exited with the Agree button checked"
AgreeChecked="User Clicked I Agree"
## Export the settings to a file on disk that can be picked up by recon later
echo -e "EULA agreement status:
Username: $loggedInUser
Full Name: $fullName
Model: $model
Computer Name: $compName
Computer Serial: $serialNumber
User Agreed?: $AgreeChecked
Agreement Date: $(date +"%b %d, %Y, %T")" > "$eulaFILE"
## Run a recon to suck up the EULA file. You will need an Extension Attribute designed to capture the contents of this file.
# echo "Gathering new inventory"
# jamf recon
## If the recon was successful
# if [[ "$?" == "0" ]]; then
## Now, clean up
## Unload the LaucnhDaemon that triggers the script
# /bin/launchctl unload /Library/LaunchDaemons/com.nameoflaunchdamon.plist
## Delete the LaunchDaemon
# /bin/rm -f "/Library/LaunchDaemon/com.nameoflaunchdaemon.plist"
## Delete the eula file
# /bin/rm "$eulaFILE"
## Delete the script last
# /bin/rm -f "$0"
else
# echo "Recon failed. Let's not delete anything until we can capture the file. Exit until next run..."
exit 0
fi
else
echo "Somehow the 'I agree' box wasn't checked. Exit until next run..."
exit 0
fi
# else
# echo "An existing eula_agreement file was found. Run recon (just in case) and then delete the file..."
# jamf recon
# /bin/rm "$eulaFILE"
# exit 0
# fi
else
## If the logged in user is root, the Mac is still sitting at the login window. Exit and wait until the next run
echo "There is no logged in user. Exit until next run..."
exit 0
fi
Also here is the Extension Attribute to gather the text file into the record:
#!/bin/sh
Result=$(cat /private/var/eula_agreement)
echo "<result>$Result</result>"
Gabe Shackney
Princeton Public Schools
