Hello'
Objective: Create smart group to report on systems that users have administrative rights.
I created the extension attribute via script. It is accurately reporting accounts that have administrative rights. The problem is when I create the logic for the smart group there is no way for me to differentiate/exclude from known admin accounts.
There are three possible admin accounts that may exist on a given system. When I create the criteria logic I make an entry for each that "is not" admdsk, and/or "is not" mbadmin and finish with "is not" blank. tried every possible combination of and's an or's with and with out parentheeses to no avail. I'm pretty sure this will require a appended script that will exclude the known accounts before output. I'm guessing this is an issue because the script output is multiple account name separated by a space. Here is the existing script that makes the extension attribute output.
!/bin/bash
Script to detect if a computer has a local admin account on it with an UID of above 500
Initialize array
list=()
generate user list of users with UID greater than 500
for username in $(dscl . list /Users UniqueID | awk '$2 > 500 { print $1 }'); do
Checks to see which usernames are reported as being admins. The
check is running dsmemberutil's check membership and listing the
accounts that are being reported as admin users. Actual check is
for accounts that are NOT not an admin (i.e. not standard users.)
if [[ $(dsmemberutil checkmembership -U "${username}" -G admin) != not ]]; then
# Any reported accounts are added to the array list
list+=("${username}")
fi
done
Prints the array's list contents
echo "result>${list[@]}</result"


