Skip to main content

Last year, I created an extension attribute for reporting if the current logged in user is an admin user. The extension attribute is below. I noticed a few months ago that this EA had stopped working. The output of the EA was blank. What got it working was to remove the "^" symbol in the results line. Removing that symbol means that the EA will report "yes" but not "Yes". We standardize all yes/no answers in EAs with capital letters. All of my EAs get pulled in by PowerBI. I can't figure how how to capitalize the first letter in the output for "isAdmin". This does work perfectly when I run it in CodeRunner either as bash or zsh. The result I need if a user is an admin is "Yes", not "yes". How can I get this to work? I know how to capitalize ALL letters in the output but I can't find anything that capitalizes the first letter. I remember when writing this EA last year, I found that using ^ is what would capitalize the output, and it was working in Jamf Pro... until just a few months ago.


#!/bin/bash

currentuser=`/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }'`
isAdmin=$(dseditgroup -o checkmember -m $currentuser admin | /usr/bin/awk '{print $1}')

echo "<result>"${isAdmin^}"</result>"

 

This is another case of me figuring out the solution before someone responded to me 🤦🏻‍  The solution was to add another awk command that handles the capitalization. There may well be another solution to this but this is what is currently working. The original EA should be working too but Jamf Pro seems to have a problem with the "^" symbol. Having that symbol makes the output of the EA blank. Here is what is currently working. I'm sharing this in case it helps someone else and I won't mark my own response as the solution 😇


 


#!/bin/bash

currentuser=`/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }'`
isAdmin=$(dseditgroup -o checkmember -m $currentuser admin | /usr/bin/awk '{print $1}' | /usr/bin/awk '{print toupper(substr($0,0,1)) tolower(substr($0,2))}')

echo "<result>"${isAdmin}"</result>"

 


 

We are using the one below, and it’s working fine as well. Just sharing for informational purposes.


#!/bin/bash

allLocalAccts=$(dscl . list /Users UniqueID | awk '$2>500 {print $1}')

while read userAcct; do
if f $(dseditgroup -o checkmember -m $userAcct admin) =~ "yes" ]]; then
Admin="Admin"
else
Admin="Regular"
fi

if f $(dscl . read /Users/$userAcct OriginalAuthenticationAuthority 2>/dev/null) != "" ]]; then
Domain="Domain"
else
Domain="Local"
fi

userList+=("${userAcct}: $Admin, $Domain")

done < <(echo "$allLocalAccts")

echo "<result>$(printf '%s
' "${userLists@]}")</result>"

 

We are using the one below, and it’s working fine as well. Just sharing for informational purposes.


#!/bin/bash

allLocalAccts=$(dscl . list /Users UniqueID | awk '$2>500 {print $1}')

while read userAcct; do
if f $(dseditgroup -o checkmember -m $userAcct admin) =~ "yes" ]]; then
Admin="Admin"
else
Admin="Regular"
fi

if f $(dscl . read /Users/$userAcct OriginalAuthenticationAuthority 2>/dev/null) != "" ]]; then
Domain="Domain"
else
Domain="Local"
fi

userList+=("${userAcct}: $Admin, $Domain")

done < <(echo "$allLocalAccts")

echo "<result>$(printf '%s
' "${userLists@]}")</result>"

 


I wrote something like this to list all the admin accounts on a Mac. I like yours better!

I use the below to list All Admin users, we used to add our Management account in the exclusion, so it will display only the user accounts with admin rights


#!/bin/bash


excludedAccounts=()

############################################################################

listAdminusers=()
listHomeDir=()
localAccounts=()

#echo "#######################################################################"
#echo " "

#echo "Found the following accounts with 'Admin rights':"
for Adminusers in $(dscl . -read /Groups/admin GroupMembership | awk '{for (i=2; i<=NF; i++) print $i}'); do

listAdminusers+=("$Adminusers")

done

#echo ${listWritersPasswd[@]}
#echo " "

#echo "Found the following accounts with homedir:"

for AdminusersAccount in ${listAdminusers[@]}; do

if [[ $(dscl . read /Users/$AdminusersAccount NFSHomeDirectory | awk '{ print $2 }') != "/var/empty" ]]; then

#echo $writersPasswdAccount

listHomeDir+=("${AdminusersAccount}")

fi

done

#echo ${listHomeDir[@]}
#echo " "

#echo "Excluding accounts: _mbsetupuser ${excludedAccounts[@]}"

for del in ${excludedAccounts[@]}
do
listHomeDir=("${listHomeDir[@]/$del}")
localAccounts=(${listHomeDir[@]})
done

#excluding _mbsetupuser

localAccounts=("${localAccounts[@]/"_mbsetupuser"}")
localAccounts=(${localAccounts[@]})
numberOfAccounts=${#localAccounts[@]}

#echo " "
#echo "#######################################################################"
#echo " "
if [ ${#localAccounts[@]} -gt 0 ];then

echo "<result>${localAccounts[@]}</result>"

else

echo "<result>No</result>"

fi

I use this command to capitalize the first letter...only works under zsh though...



va="${(C)var%%.*}"

my EA script to get local admins:


#!/bin/zsh

declare -a adminUsers
declare -a result

function join { local IFS="$1"; shift; echo "$*"; }
function members { dscl . -list /Users UniqueID | awk '$2 > 499 {print $1}'| while read user; do printf "$user "; dsmemberutil checkmembership -U "$user" -G "$*"; done | grep "is a member" | cut -d " " -f 1; }

adminUsers=$( members "admin" )
result=$(join , ${adminUsers[@]})

echo "<result>$result</result>"

Reply


Terms & ConditionsCookie settings