Mac OS LAPS

[Matt_Roy93]

Does anyone have any experience utilizing Jamf Connect login LAPS functionality? https://travellingtechguy.blog/jamf-connect-and-laps/ Following this link there is specific plist config info called out for LAPS control built into Jamf Connect, our intended use case would be finding something that can manage our local admin passwords without being AD bound and securely using the FV2 escrow key seems like an interesting idea.  Any thoughts on best practice?

[rossmclaren · Accepted solution]

Here is the script we use:

#!/bin/sh
####################################################################################################
#
#   MIT License
#
#   Copyright (c) 2016 University of Nebraska–Lincoln
#
#	Permission is hereby granted, free of charge, to any person obtaining a copy
#   of this software and associated documentation files (the "Software"), to deal
#   in the Software without restriction, including without limitation the rights
#   to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
#   copies of the Software, and to permit persons to whom the Software is
#   furnished to do so, subject to the following conditions:
#
#   The above copyright notice and this permission notice shall be included in all
#   copies or substantial portions of the Software.
#
#   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
#   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
#   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
#   AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
#   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
#   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
#   SOFTWARE.
#
####################################################################################################
#
# HISTORY
#
#	Version: 1.4
#
#	- 04/29/2016 Created by Phil Redfern
#   - 05/01/2016 Updated by Phil Redfern, added upload verification and local Logging.
#   - 05/02/2016 Updated by Phil Redfern and John Ross, added keychain update and fixed a bug where no stored LAPS password would cause the process to hang.
#   - 05/06/2016 Updated by Phil Redfern, improved local logging and increased random passcode length.
#   - 05/11/2016 Updated by Phil Redfern, removed ambiguous characters from the password generator.
#
#   - This script will randomize the password of the specified user account and post the password to the LAPS Extention Attribute in Jamf.
#  Version 1.5
#   - 8 Sep 2020 Mark Lamont  Removed reliance on API user thus closing security hole. Now uses standard inventory function to update.
#   - Password does remain on the device though but is obscured and only available to root user.
#   - Not written to work with FileVault enabled admin users because of all the issues with secure token
#
####################################################################################################
#
# DEFINE VARIABLES & READ IN PARAMETERS
#
####################################################################################################

resetUser=""
basePassword=""
# CHECK TO SEE IF A VALUE WAS PASSED IN PARAMETER 4 AND, IF SO, ASSIGN TO "resetUser"
if [ "$4" != "" ] && [ "$resetUser" == "" ];then
resetUser=$4
fi

# CHECK TO SEE IF A VALUE WAS PASSED IN PARAMETER 5 AND, IF SO, ASSIGN TO "initialPassword"
if [ "$5" != "" ] && [ "$basePassword" == "" ];then
basePassword=$5
fi

udid=$(/usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, "\""); printf("%s\n", line[4]); }')

LogLocation="/Library/Logs/Jamf_LAPS.log"
LAPSFileLocation="/usr/local/jamf/$udid/"
if [ ! -d "$LAPSFileLocation" ]; then
mkdir -p $LAPSFileLocation
chmod 600 $LAPSFileLocation
fi

LAPSFile="$LAPSFileLocation.$udid"

newPass=$(openssl rand -base64 10 | tr -d OoIi1lLS | head -c12;echo)
####################################################################
#
#            ┌─── openssl is used to create
#            │	a random Base64 string
#            │                    ┌── remove ambiguous characters
#            │                    │
# ┌──────────┴──────────┐	  ┌───┴────────┐
# openssl rand -base64 10 | tr -d OoIi1lLS | head -c12;echo
#                                            └──────┬─────┘
#                                                   │
#             prints the first 12 characters  ──────┘
#             of the randomly generated string
#
####################################################################################################
#
# SCRIPT CONTENTS - DO NOT MODIFY BELOW THIS LINE
#
####################################################################################################

# jamf binary path
jamf_binary="/usr/local/jamf/bin/jamf"
# Logging Function for reporting actions
ScriptLogging(){

DATE=$(date +%Y-%m-%d\ %H:%M:%S)
LOG="$LogLocation"

echo "$DATE" " $1" >> $LOG
}

ScriptLogging "======== Starting LAPS Update ========"
ScriptLogging "Checking parameters."

if [ "$resetUser" == "" ];then
    ScriptLogging "Error:  The parameter 'User to Reset' is blank.  Please specify a user to reset."
    echo "Error:  The parameter 'User to Reset' is blank.  Please specify a user to reset."
    ScriptLogging "======== Aborting LAPS Update ========"
    exit 1
fi

# Verify resetUser is a local user on the computer
checkUser=$(dseditgroup -o checkmember -m $resetUser localaccounts | awk '{ print $1 }')

if [[ "$checkUser" = "yes" ]];then
    echo "$resetUser is a local user on the Computer"
else
    echo "Error: $checkUser is not a local user on the Computer!"
    ScriptLogging "======== Aborting LAPS Update ========"
    exit 1
fi

ScriptLogging "Parameters Verified."

# Update the User Password
RunLAPS (){
ScriptLogging "Running LAPS..."

if [[ "$secureTokenStatus" = "DISABLED" ]]; then

    ScriptLogging "Updating password for $resetUser."
    echo "Updating password."
    $jamf_binary resetPassword -username $resetUser -password $newPass
else
    ScriptLogging "*** Secure Token Enabled! ***"
    sysadminctl -resetPasswordFor "$resetUser" -newPassword "$newPass" -adminUser "$resetUser" -adminPassword "$basePassword"
    
    
fi

}

# Verify the new User Password
CheckNewPassword (){
ScriptLogging "Verifying new password for $resetUser."
passwdB=`dscl /Local/Default -authonly $resetUser $newPass`

if [ "$passwdB" == "" ];then
    ScriptLogging "New password for $resetUser is verified."
    echo "New password for $resetUser is verified."
else
    ScriptLogging "Error: Password reset for $resetUser was not successful!"
    echo "Error: Password reset for $resetUser was not successful!"
    ScriptLogging "======== Aborting LAPS Update ========"
    exit 1
fi
}

# Update the LAPS Extention Attribute
UpdateJamf (){
ScriptLogging "Recording new password for $resetUser into LAPS."
# debug
# ScriptLogging "*** new pass is $newPass ***"
touch $LAPSFile

#echo "$resetUser|$newPass" > $LAPSFile
echo "$newPass" > $LAPSFile

# EA must be in Jamf to record the value
jamf recon

}

checkSecureTokenStatus () {

secureTokenStatus=$(sysadminctl -secureTokenStatus $resetUser 2>&1 | awk '{ print $7 }' | sed s'/ //g')

ScriptLogging "secure token for $resetUser is $secureTokenStatus"

}

checkIfRunBefore () {

if [ -f "$LAPSFile" ]; then
    previousPassword=$(cat $LAPSFile)
    basePassword=${previousPassword}
    # Debug
    #ScriptLogging "base password is $basePassword"

fi

}
#====================================================
# The script itself

checkSecureTokenStatus
checkIfRunBefore
RunLAPS
CheckNewPassword
UpdateJamf

ScriptLogging "======== LAPS Update Finished ========"
echo "LAPS Update Finished."

exit 0

You will also need to use this below as an Extension Attribute:

#!/bin/sh

###################################
# EA to update LAPS Password      #
###################################
udid=$(/usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, "\""); printf("%s\n", line[4]); }')
LAPSFileLocation="/usr/local/jamf/$udid/"
LAPSFile="$LAPSFileLocation.$udid"

if [[ -f "$LAPSFile" ]]; then
   value=$(cat $LAPSFile)
   echo "<result>$value</result>"
   else
   value="Not recorded"
fi

[rossmclaren · Accepted solution]

Here is the script we use:

#!/bin/sh
####################################################################################################
#
#   MIT License
#
#   Copyright (c) 2016 University of Nebraska–Lincoln
#
#	Permission is hereby granted, free of charge, to any person obtaining a copy
#   of this software and associated documentation files (the "Software"), to deal
#   in the Software without restriction, including without limitation the rights
#   to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
#   copies of the Software, and to permit persons to whom the Software is
#   furnished to do so, subject to the following conditions:
#
#   The above copyright notice and this permission notice shall be included in all
#   copies or substantial portions of the Software.
#
#   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
#   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
#   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
#   AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
#   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
#   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
#   SOFTWARE.
#
####################################################################################################
#
# HISTORY
#
#	Version: 1.4
#
#	- 04/29/2016 Created by Phil Redfern
#   - 05/01/2016 Updated by Phil Redfern, added upload verification and local Logging.
#   - 05/02/2016 Updated by Phil Redfern and John Ross, added keychain update and fixed a bug where no stored LAPS password would cause the process to hang.
#   - 05/06/2016 Updated by Phil Redfern, improved local logging and increased random passcode length.
#   - 05/11/2016 Updated by Phil Redfern, removed ambiguous characters from the password generator.
#
#   - This script will randomize the password of the specified user account and post the password to the LAPS Extention Attribute in Jamf.
#  Version 1.5
#   - 8 Sep 2020 Mark Lamont  Removed reliance on API user thus closing security hole. Now uses standard inventory function to update.
#   - Password does remain on the device though but is obscured and only available to root user.
#   - Not written to work with FileVault enabled admin users because of all the issues with secure token
#
####################################################################################################
#
# DEFINE VARIABLES & READ IN PARAMETERS
#
####################################################################################################

resetUser=""
basePassword=""
# CHECK TO SEE IF A VALUE WAS PASSED IN PARAMETER 4 AND, IF SO, ASSIGN TO "resetUser"
if [ "$4" != "" ] && [ "$resetUser" == "" ];then
resetUser=$4
fi

# CHECK TO SEE IF A VALUE WAS PASSED IN PARAMETER 5 AND, IF SO, ASSIGN TO "initialPassword"
if [ "$5" != "" ] && [ "$basePassword" == "" ];then
basePassword=$5
fi

udid=$(/usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, "\""); printf("%s\n", line[4]); }')

LogLocation="/Library/Logs/Jamf_LAPS.log"
LAPSFileLocation="/usr/local/jamf/$udid/"
if [ ! -d "$LAPSFileLocation" ]; then
mkdir -p $LAPSFileLocation
chmod 600 $LAPSFileLocation
fi

LAPSFile="$LAPSFileLocation.$udid"

newPass=$(openssl rand -base64 10 | tr -d OoIi1lLS | head -c12;echo)
####################################################################
#
#            ┌─── openssl is used to create
#            │	a random Base64 string
#            │                    ┌── remove ambiguous characters
#            │                    │
# ┌──────────┴──────────┐	  ┌───┴────────┐
# openssl rand -base64 10 | tr -d OoIi1lLS | head -c12;echo
#                                            └──────┬─────┘
#                                                   │
#             prints the first 12 characters  ──────┘
#             of the randomly generated string
#
####################################################################################################
#
# SCRIPT CONTENTS - DO NOT MODIFY BELOW THIS LINE
#
####################################################################################################

# jamf binary path
jamf_binary="/usr/local/jamf/bin/jamf"
# Logging Function for reporting actions
ScriptLogging(){

DATE=$(date +%Y-%m-%d\ %H:%M:%S)
LOG="$LogLocation"

echo "$DATE" " $1" >> $LOG
}

ScriptLogging "======== Starting LAPS Update ========"
ScriptLogging "Checking parameters."

if [ "$resetUser" == "" ];then
    ScriptLogging "Error:  The parameter 'User to Reset' is blank.  Please specify a user to reset."
    echo "Error:  The parameter 'User to Reset' is blank.  Please specify a user to reset."
    ScriptLogging "======== Aborting LAPS Update ========"
    exit 1
fi

# Verify resetUser is a local user on the computer
checkUser=$(dseditgroup -o checkmember -m $resetUser localaccounts | awk '{ print $1 }')

if [[ "$checkUser" = "yes" ]];then
    echo "$resetUser is a local user on the Computer"
else
    echo "Error: $checkUser is not a local user on the Computer!"
    ScriptLogging "======== Aborting LAPS Update ========"
    exit 1
fi

ScriptLogging "Parameters Verified."

# Update the User Password
RunLAPS (){
ScriptLogging "Running LAPS..."

if [[ "$secureTokenStatus" = "DISABLED" ]]; then

    ScriptLogging "Updating password for $resetUser."
    echo "Updating password."
    $jamf_binary resetPassword -username $resetUser -password $newPass
else
    ScriptLogging "*** Secure Token Enabled! ***"
    sysadminctl -resetPasswordFor "$resetUser" -newPassword "$newPass" -adminUser "$resetUser" -adminPassword "$basePassword"
    
    
fi

}

# Verify the new User Password
CheckNewPassword (){
ScriptLogging "Verifying new password for $resetUser."
passwdB=`dscl /Local/Default -authonly $resetUser $newPass`

if [ "$passwdB" == "" ];then
    ScriptLogging "New password for $resetUser is verified."
    echo "New password for $resetUser is verified."
else
    ScriptLogging "Error: Password reset for $resetUser was not successful!"
    echo "Error: Password reset for $resetUser was not successful!"
    ScriptLogging "======== Aborting LAPS Update ========"
    exit 1
fi
}

# Update the LAPS Extention Attribute
UpdateJamf (){
ScriptLogging "Recording new password for $resetUser into LAPS."
# debug
# ScriptLogging "*** new pass is $newPass ***"
touch $LAPSFile

#echo "$resetUser|$newPass" > $LAPSFile
echo "$newPass" > $LAPSFile

# EA must be in Jamf to record the value
jamf recon

}

checkSecureTokenStatus () {

secureTokenStatus=$(sysadminctl -secureTokenStatus $resetUser 2>&1 | awk '{ print $7 }' | sed s'/ //g')

ScriptLogging "secure token for $resetUser is $secureTokenStatus"

}

checkIfRunBefore () {

if [ -f "$LAPSFile" ]; then
    previousPassword=$(cat $LAPSFile)
    basePassword=${previousPassword}
    # Debug
    #ScriptLogging "base password is $basePassword"

fi

}
#====================================================
# The script itself

checkSecureTokenStatus
checkIfRunBefore
RunLAPS
CheckNewPassword
UpdateJamf

ScriptLogging "======== LAPS Update Finished ========"
echo "LAPS Update Finished."

exit 0

You will also need to use this below as an Extension Attribute:

#!/bin/sh

###################################
# EA to update LAPS Password      #
###################################
udid=$(/usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, "\""); printf("%s\n", line[4]); }')
LAPSFileLocation="/usr/local/jamf/$udid/"
LAPSFile="$LAPSFileLocation.$udid"

if [[ -f "$LAPSFile" ]]; then
   value=$(cat $LAPSFile)
   echo "<result>$value</result>"
   else
   value="Not recorded"
fi

[LzGygoox]

You can combine this solution with openssl enc to keep the secret safe, even if the logged user is admin.

[WsIT]

I also think that is a bit risky to store the LAPS password locally without any encryption.
Can you please elaborate on how can I encrypt it using openssl?

Thanks!

[LzGygoox]

Hi, sure!

You should first at all keep in mind that some special chars cannot be part of the password. Make some tests before implement so you can avoid issues.

You can start generating with the script, creating a temp file with the pass, then encrypt using it as input file (-in), and passing the output destination (-out), in the example bellow we are using the same location as the original script uses, but as it will be encrypted, you can select any other location. We want to encrypt the password without salt (-nosalt), as it is an easiest way to revert and, and after that we are encoding to BASE64 (-base64), I think you can avoid it (if you want), but I didn't tested it. We are removing the file to avoid keep boths, but you can keep both while testing.

LAPSTmpFile = /path/to/tmp/file
encPassword = password
echo "$newPass" > $LAPSTmpFile
openssl enc -algorithm -in $LAPSTmpFile -out $LAPSFile -nosalt -base64 -k $encPassword
rm $LAPSTmpFile

Here you have some info about openssl enc: https://www.openssl.org/docs/man1.0.2/man1/openssl-enc.html

Then, in your extension attribute you should read the file and decrypt (-d) the pass (using the same algorithm). You should do the same if you want to use the pass in policies, or other scripts.

password=$(openssl enc -algorithm -d -in $LAPSFile -nosalt -base64 -k $encPassword)

I think that it is a little bit more secure, as you can keep the file but you cannot get the admin password without encPassword.

We have some tests running, and no issues were detected yet.

[WsIT]

Thanks a lot!
I will try it today and will let you know!

[bmack99]

Any issues with the above posted script / LAPS solution on macOS 11.x? We were pursuing implementing LAPS awhile back but saw all kinds of griping about it not working in Big Sur.

[rossmclaren]

No issues with it on Big Sur yet!

[jamf_sam]

This could be worth looking into as well: https://marketplace.jamf.com/details/easylaps/

[Matt_Roy93]

Thank you all for the responses much appreciated!

Honestly I am not as concerned about having the local admin account be FV2 enabled and have secure tokens as it will never be actually logged into, it will only be used by support to run elevated commands and installs, if needed. 

We are in the process of getting Beyond Trusts EPM solution and we could remove the existence of the local admin account and make support authenticate against our AAD service embedded with this product I am just not sure how that looks.

[MacJunior]

@rossmclaren sorry if it's a stupid question but would it be possible to tune the script to generate a password that would meet our password policy?

[LzGygoox]

@MacJuniorI think that you could add a validation function (for example) and a "apply policy" function also. So you can validate first if it accomplish your policy and if not, you can enforce it with apply policy (which maybe will add a random special char in somewhere in the string, or change few chars to uppercase, or something similar to make it compliant with your policy) 😄

[perryd84 · Accepted solution]

I've been working on a LAPS solution for macs and have created a couple of scripts to manage the cycle of the password and account creation and an app to show the password when it's needed.

Some other LAPS for mac solutions display the admin password in plain text in Jamf which is a massive security risk. My script encrypts it all and never displays the password unless you use the decryption script which you can scope to just admin users.

I've detailed the setup on my github and the scripts are there as well.
https://github.com/PezzaD84/macOSLAPS

Check it out to see if it does what you need.

[Matt_Roy93]

@perryd84 This is awesome work, I am excited to see if we can implement and use this effectively in our environment, Thanks! 

[Matt_Roy93]

@perryd84 I do have one probably dumb question with configuration, everything else is very straightforward and easy to setup but I am wondering what the Encrypted API credentials field under parameter 5 of the script is asking for, does this want the actual account with API access name followed by the password delimited by comma or semi-colon?  OR does this want the actual bearer token information provided after basic auth takes place with username and password? 

[perryd84]

So I encrypt the API username and password and then use that encrypted string to get the bearer token from jamf. Once you have the encrypted credentials you don't need to run the encryption and can remove your plain text API details from all your scripts.

The script below will encrypt the account and then generate a token. You can take the token part and the encrypted credentials and use them in other API scripts. You only need the encode part once.

#!/bin/bash

apiuser=APIUser
apipasswd=APIPassword
url=JSSURL

# created base64-encoded credentials
encodedCredentials=$( printf "$apiuser:$apipasswd" | /usr/bin/iconv -t ISO-8859-1 | /usr/bin/base64 -i - )

echo $encodedCredentials

token=$(curl -s -H "Content-Type: application/json" -H "Authorization: Basic ${encodedCredentials}" -X POST "$url/api/v1/auth/token" | grep 'token' | tr '"' ' ' | awk '{print $3}' | xargs)

[MacJunior]

@perryd84 Can't find any scripts, did you remove it?

[MacJunior]

can you share your script again please?

[perryd84]

Just sent you a private message👍🏻

[mks007]

Hey @perryd84  any chance you could share your script with me?

[perryd84]

Hi @mks007 
Just need to finish the write up for the new version and I will make the repository live again.

I'll drop a message once its up👍🏻

[Evinrude]

I like you article but your script LAPS Create Cycel Password is failing with the error message unknow command. Can you help me with this 

[perryd84]

Hi @Evinrude

Do you have a log from jamf or the local Lapslog? If you can share this I can take a look.

[Evinrude]

LAPS Logs 

LAPS Configuration has failed
Cryptkey has not been successfully configured
SecretKey has not been successfully configured
***** LAPS Account cycled 16/02/2023 13:32:40
Password length has been set to characters
does not exist. Creating local admin now
Device serial is C02G71K3ML7H
JAMF ID is
LAPS Configuration has failed
Cryptkey has not been successfully configured
SecretKey has not been successfully configured

-------------------------------------------------------------------------------

script MacOS - LAPS - Create Admin & Cycle Password...
Script exit code: 0
Script result: Log already exists. Continuing setup.....
***** LAPS Account cycled 16/02/2023 15:59:34
Password length has been set to  characters
/Library/Application Support/JAMF/tmp/MacOS - LAPS - Create Admin & Cycle Password: line 58: ==: command not found
cut: [-bcf] list: values may not include zero
usage: grep [-abcdDEFGHhIiJLlMmnOopqRSsUVvwXxZz] [-A num] [-B num] [-C[num]]
	[-e pattern] [-f file] [--binary-files=value] [--color=when]
	[--context[=num]] [--directories=action] [--label] [--line-buffered]
	[--null] [pattern] [file ...]
 does not exist. Creating local admin now
2023-02-16 15:59:34.713 sysadminctl[36742:231693] Usage: sysadminctl
	-deleteUser <user name> [-secure || -keepHome] (interactive || -adminUser <administrator user name> -adminPassword <administrator password>)
	-newPassword <new password> -oldPassword <old password> [-passwordHint <password hint>]
	-resetPasswordFor <local user name> -newPassword <new password> [-passwordHint <password hint>] (interactive] || -adminUser <administrator user name> -adminPassword <administrator password>)
	-addUser <user name> [-fullName <full name>] [-UID <user ID>] [-GID <group ID>] [-shell <path to shell>] [-password <user password>] [-hint <user hint>] [-home <full path to home>] [-admin] [-roleAccount] [-picture <full path to user image>] (interactive] || -adminUser <administrator user name> -adminPassword <administrator password>)
	-secureTokenStatus <user name>
	-secureTokenOn <user name> -password <password> (interactive || -adminUser <administrator user name> -adminPassword <administrator password>)
	-secureTokenOff <user name> -password <password> (interactive || -adminUser <administrator user name> -adminPassword <administrator password>)
	-guestAccount <on || off || status>
	-afpGuestAccess <on || off || status>
	-smbGuestAccess <on || off || status>
	-automaticTime <on || off || status>
	-filesystem status
	-screenLock <status || immediate || off || seconds> -password <password>

Pass '-' instead of password in commands above to request prompt.
'-adminPassword' used mostly for scripted operation. Use '-' or 'interactive' to get the authentication string interactively. This preferred for security reasons

	*Role accounts require name starting with _ and UID in 200-400 range.
usage: grep [-abcdDEFGHhIiJLlMmnOopqRSsUVvwXxZz] [-A num] [-B num] [-C[num]]
	[-e pattern] [-f file] [--binary-files=value] [--color=when]
	[--context[=num]] [--directories=action] [--label] [--line-buffered]
	[--null] [pattern] [file ...]
/Library/Application Support/JAMF/tmp/MacOS - LAPS - Create Admin & Cycle Password: line 140: /Users//Library/Preferences/com.apple.SetupAssistant.plist: No such file or directory
chown: /Users//Library/Preferences/com.apple.SetupAssistant.plist: No such file or directory
chmod: /Users//Library/Preferences/com.apple.SetupAssistant.plist: No such file or directory
Device serial is C02G71K3ML7H

[perryd84]

Thanks for sharing this.

Was the script run from jamf or run locally? Has any modification to the script been done?

It looks like some variables are missing in the failed commands. Also not sure what the "line 58 command not found" error is, as in the script there's nothing on line 58. The result you've shared looks like it's trying to run == as a command which is very odd.

[Evinrude]

We are running this script from the Jamf Only. We haven't made any modification in the script apart from removing the slack notification part from the script.

Its fails in line 58 which is 
if $specialchar == true ; then
password=$(openssl rand -base64 32 | tr -d '/' | tr -d '\' | tr -d ' ' | cut -c -$length | cut -c 2-)

[perryd84]

Ah ok that's line 68 in the current version.

Are you entering a true or false flag in parameter 8 in the script policy? If the variable is left blank then the if statement will have nothing to compare so that could be why it's trying to run == as a command. 

[Evinrude]

Yes, i am entering a true flag in parameter 8 in the script policy. Its weird why is failing 

[perryd84]

It's really odd. It's not pulling in any of the parameters set in jamf or something is stripping the variables. 

You can see all the parameter options are blank.

"Password length is set to (blank) characters" 

"(blank) does not exist" 

Then the if statement is failing as parameter 8 is coming through as blank.

You can also see the plist creation part is failing as there is no user being populated into the file path. 

Really odd issue can't say I've seen this before. I would test another script to see if variables set in the jamf policy are being striped out as well.

[Evinrude]

Okay ..I have made the parameter vule as blank and assign the value in the script and running the script again and below is the output 

===========================================

cript MacOS - LAPS - Create Admin & Cycle Password...
Script exit code: 1
Script result: Log already exists. Continuing setup.....
***** LAPS Account cycled 17/02/2023 15:15:29
Password length has been set to 16 characters
A Special character has been set in the password
GroupMembership: root XXXAdmin 
XXXAdmin has already been created and is a local admin. Resetting local admin password....
error reading input file
2023-02-17 15:15:32.094 sysadminctl[13006:77173] Operation is not permitted without secure token unlock.
<dscl_cmd> DS Error: -14090 (eDSAuthFailed)
Authentication for node /Local/Default failed. (-14090, eDSAuthFailed)
Password validation failed.

[Evinrude]

I have removed the parameter and inserted the value in the script itself and below is the output
Running Script MacOS - LAPS - Create Admin & Cycle Password...
Script exit code: 1
Script result: Log already exists. Continuing setup.....
***** LAPS Account cycled 17/02/2023 15:15:29
Password length has been set to 16 characters
A Special character has been set in the password
GroupMembership: root xxxAdmin
xxxAdmin has already been created and is a local admin. Resetting local admin password....
error reading input file
2023-02-17 15:15:32.094 sysadminctl[13006:77173] Operation is not permitted without secure token unlock.
<dscl_cmd> DS Error: -14090 (eDSAuthFailed)
Authentication for node /Local/Default failed. (-14090, eDSAuthFailed)
Password validation failed.

[Evinrude]

Hello @perryd84 
Did you get the chance to look into the above error "Operation is not permitted without secure token unlock"

[perryd84]

Hi @Evinrude sorry completely missed these updates.

I would remove the local account completely before re-running the script. If the account has been created and the password reset has failed, the encoded password will be updated and escrowed to jamf but it will no longer be the same as the local account. In this case the real password will never be able to be recovered and reset so its best to have a clean slate.

I'm actually in the process of creating a reset script which will set the whole process back to a clean state to avoid any issues such as this.

[Matt_Roy93]

@perryd84 this is exactly what I was looking for thank you!

[Matt_Roy93]

@perryd84 I am still having issues, I am able to obtain the API credential via Postman but the string is too long to import to the script parameter, In this script you shared above I am not able to receive an output or understand what is being done are you willing to help elaborate?  I apologize for asking so many questions :)

[perryd84]

Hi @Matt_Roy93

No problem at all mate! Not quite sure I'm following where you are getting stuck? Which string is too long? It should be in a variable and not just posted as the string. I don't use postman as I actually find it makes things like this harder (personally) as its not really for scripting. I use coderunner to run all my scripts including API calls.

The script I've posted above is mainly just to get the bearer token. The first part is encrypting your API account the second part is using that encrypted account to get the token.

[greygoose]

Hi @Matt_Roy93

Thanks for this utility and I hope to use it soon - just a note to say I followed the steps a few times now and find that the extension attribute fields never seem to populate - what should be in showing in the LAPS secret EA ?

Also the Self Service command never reveals the unencrypted pw as a result.

I ran my creds and URL (non SS0)  via your script in BBEdit and got what I think is the correct Encrypted API credentials similar to (c888888888888888888888888888888888U=) and no errors in the logs of the policy are showing

any ideas where I'm going wrong?

[greygoose]

FYI - I followed @rossmclaren script instead and all seemed ok until the macOS 12.6 update was released - now errors on every Mac I try!!

[perryd84]

@mks007 the github repository is back up now you can check it here https://github.com/PezzaD84/macOSLAPS

[caio_clemente]

@perryd84 , good afternoon.
For me, it was not clear, which user I use in the API credential?