One thing to be aware of is the Users with admin rights are able to create other users and give those admin rights...
I have a quick script which writes all existing admin accounts to a text file then when the Admin rights are removed or timed out another script is run to do a comparison to the original Admin users and move any new accounts back to standard accounts, then write these new accounts to an EA.

We are going with the "MakeMeAnAdmin" script, though I was asked to also build out a mechanism in which the user would be required to enter the reason they are giving themselves temporary administrator rights.

I am using 3 different steps to accomplish this; 1) MakeMeAnAdmin policy with a custom trigger, 2) Self Service policy with a custom script which prompts the user for a reason (documents it in a file) and then triggers the MakeMeAnAdmin policy, and 3) an Extension Attribute which scrapes the "reason" file, and populates that information in the devices Extension Attribute section. Since there is not a way (that I am aware of) to notify the Jamf admin when a policy is run, this also allows you to create a Smart Group (w/ email notifications on group change) notifying you when a user has run this policy.

I have tested this process, and it does work as I intended. As I would definitely classify myself as a scripting noob, please excuse any glaring mistakes with the code below. Hopefully this may help someone out in a similar situation.

Script to prompt for reason

#!/bin/sh

# Display dialog asking the user for the reason why they need administrator rights

adminReason=$(/usr/bin/osascript<<END

tell application "System Events"

activate

set the answer to text returned of (display dialog "You are about to be granted with temporary administrator rights. Please describe what you intend to do with your temporary admin rights." with title "Temporary Admin Rights" default answer "")

end tell

END)



# While loop to have the user provide an answer of at least so many characters long

while True ; do

[[ ${#adminReason} -ge 20 ]] && break

echo "Sorry that string isnt long enough."

adminReason=$(/usr/bin/osascript<<END

tell application "System Events"

activate

set the answer to text returned of (display dialog "You did not provide a sufficient answer. As you are about to be granted with temporary administrator rights. Please describe what you intend to do with your temporary admin rights." with title "Temporary Admin Rights" default answer "")

end tell

END)

done



# Get Current user

loggedInUser=`python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDynamicStoreCopyConsoleUser(None, None, None) or [None])[0]; username = [username,""][username in [u"loginwindow", None, u""]]; sys.stdout.write(username + "

");'`



# Specify output file path

filepath="/Library/Application Support/companyName/Extension Attributes/"



# Get Date & Time

dt=`date '+%m-%d-%y_%H:%M:%S'`



# Check to see if the Users output filepath exists

if [[ -d ${filepath} ]]; then

    echo "Extension Attribute folder exists. Moving on."



else 

    echo "Extension Attribute folder does not exist. Creating it now"

    mkdir "$filepath"



fi



# Create Reason file

file="${filepath}AdminReason.txt"

echo "${dt}_${loggedInUser}_${adminReason}" >> "$file"



# Run the temporary admin policy

/usr/local/jamf/bin/jamf policy -event tempAdmin



# Notify the user they have been granted temporary admin rights

osascript -e 'display dialog "You now have administrative rights for 15 minutes. DO NOT ABUSE THIS PRIVILEGE..." buttons {"I Understand"} default button 1'



exit 0

Extension Attribute scraping the "reason" file

#!/bin/sh

outputFile="/Library/Application Support/companyName/Extension Attributes/AdminReason.txt"

fileContent=$( cat "$outputFile" )



if [[ -e "$outputFile" ]]; then

    echo "<result>$fileContent</result>"



else

    echo "<result>NotGrantedAdminRights</result>"



fi

is there a way to make myself a temporary admin for much longer than 30 minutes by changing the macOS date to, say, 2030.

In this case, the jamf is not connecting. 

Can someone advise?

Thanks 

use the script above and change the amount of time to what you want

not sure i want to mess with scripts that way. I was thinking of changing the date before/whilst the script is running and then change the date back. 

Any advice? 

We have this setup a slightly different way.

1) A policy > script to elevate current user to admin, available in self-service - This is scoped to a static group, 'admin users'. We manually add machines into this group when admin is needed. i.e for software installs etc.
2) A policy > script that removes all users from the admin group, except for our management account. This is scoped to all machines. Triggered at startup.

Only machines that are in the static group have the elevate to local admin script available in self-service. Admin resets back to standard user on reboot for all machines at startup.

Works well for us - We often have a ticket open when someone needs temporary admin (Software installs etc) so we simply add their machine to the static group and remove it once they're finished.

If anyone needs the scripts let me know & I'll dig them out.