Jamf Nation Community

Matt_Roy93 · ‎09-16-2021

Does anyone have any experience utilizing Jamf Connect login LAPS functionality? https://travellingtechguy.blog/jamf-connect-and-laps/ Following this link there is specific plist config info called out for LAPS control built into Jamf Connect, our intended use case would be finding something that can manage our local admin passwords without being AD bound and securely using the FV2 escrow key seems like an interesting idea. Any thoughts on best practice?

rossmclaren · ‎09-17-2021

Here is the script we use:

#!/bin/sh
####################################################################################################
#
#   MIT License
#
#   Copyright (c) 2016 University of Nebraska–Lincoln
#
#	Permission is hereby granted, free of charge, to any person obtaining a copy
#   of this software and associated documentation files (the "Software"), to deal
#   in the Software without restriction, including without limitation the rights
#   to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
#   copies of the Software, and to permit persons to whom the Software is
#   furnished to do so, subject to the following conditions:
#
#   The above copyright notice and this permission notice shall be included in all
#   copies or substantial portions of the Software.
#
#   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
#   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
#   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
#   AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
#   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
#   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
#   SOFTWARE.
#
####################################################################################################
#
# HISTORY
#
#	Version: 1.4
#
#	- 04/29/2016 Created by Phil Redfern
#   - 05/01/2016 Updated by Phil Redfern, added upload verification and local Logging.
#   - 05/02/2016 Updated by Phil Redfern and John Ross, added keychain update and fixed a bug where no stored LAPS password would cause the process to hang.
#   - 05/06/2016 Updated by Phil Redfern, improved local logging and increased random passcode length.
#   - 05/11/2016 Updated by Phil Redfern, removed ambiguous characters from the password generator.
#
#   - This script will randomize the password of the specified user account and post the password to the LAPS Extention Attribute in Jamf.
#  Version 1.5
#   - 8 Sep 2020 Mark Lamont  Removed reliance on API user thus closing security hole. Now uses standard inventory function to update.
#   - Password does remain on the device though but is obscured and only available to root user.
#   - Not written to work with FileVault enabled admin users because of all the issues with secure token
#
####################################################################################################
#
# DEFINE VARIABLES & READ IN PARAMETERS
#
####################################################################################################

resetUser=""
basePassword=""
# CHECK TO SEE IF A VALUE WAS PASSED IN PARAMETER 4 AND, IF SO, ASSIGN TO "resetUser"
if [ "$4" != "" ] && [ "$resetUser" == "" ];then
resetUser=$4
fi

# CHECK TO SEE IF A VALUE WAS PASSED IN PARAMETER 5 AND, IF SO, ASSIGN TO "initialPassword"
if [ "$5" != "" ] && [ "$basePassword" == "" ];then
basePassword=$5
fi

udid=$(/usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, "\""); printf("%s\n", line[4]); }')

LogLocation="/Library/Logs/Jamf_LAPS.log"
LAPSFileLocation="/usr/local/jamf/$udid/"
if [ ! -d "$LAPSFileLocation" ]; then
mkdir -p $LAPSFileLocation
chmod 600 $LAPSFileLocation
fi

LAPSFile="$LAPSFileLocation.$udid"

newPass=$(openssl rand -base64 10 | tr -d OoIi1lLS | head -c12;echo)
####################################################################
#
#            ┌─── openssl is used to create
#            │	a random Base64 string
#            │                    ┌── remove ambiguous characters
#            │                    │
# ┌──────────┴──────────┐	  ┌───┴────────┐
# openssl rand -base64 10 | tr -d OoIi1lLS | head -c12;echo
#                                            └──────┬─────┘
#                                                   │
#             prints the first 12 characters  ──────┘
#             of the randomly generated string
#
####################################################################################################
#
# SCRIPT CONTENTS - DO NOT MODIFY BELOW THIS LINE
#
####################################################################################################

# jamf binary path
jamf_binary="/usr/local/jamf/bin/jamf"
# Logging Function for reporting actions
ScriptLogging(){

DATE=$(date +%Y-%m-%d\ %H:%M:%S)
LOG="$LogLocation"

echo "$DATE" " $1" >> $LOG
}

ScriptLogging "======== Starting LAPS Update ========"
ScriptLogging "Checking parameters."

if [ "$resetUser" == "" ];then
    ScriptLogging "Error:  The parameter 'User to Reset' is blank.  Please specify a user to reset."
    echo "Error:  The parameter 'User to Reset' is blank.  Please specify a user to reset."
    ScriptLogging "======== Aborting LAPS Update ========"
    exit 1
fi

# Verify resetUser is a local user on the computer
checkUser=$(dseditgroup -o checkmember -m $resetUser localaccounts | awk '{ print $1 }')

if [[ "$checkUser" = "yes" ]];then
    echo "$resetUser is a local user on the Computer"
else
    echo "Error: $checkUser is not a local user on the Computer!"
    ScriptLogging "======== Aborting LAPS Update ========"
    exit 1
fi

ScriptLogging "Parameters Verified."

# Update the User Password
RunLAPS (){
ScriptLogging "Running LAPS..."

if [[ "$secureTokenStatus" = "DISABLED" ]]; then

    ScriptLogging "Updating password for $resetUser."
    echo "Updating password."
    $jamf_binary resetPassword -username $resetUser -password $newPass
else
    ScriptLogging "*** Secure Token Enabled! ***"
    sysadminctl -resetPasswordFor "$resetUser" -newPassword "$newPass" -adminUser "$resetUser" -adminPassword "$basePassword"
    
    
fi

}

# Verify the new User Password
CheckNewPassword (){
ScriptLogging "Verifying new password for $resetUser."
passwdB=`dscl /Local/Default -authonly $resetUser $newPass`

if [ "$passwdB" == "" ];then
    ScriptLogging "New password for $resetUser is verified."
    echo "New password for $resetUser is verified."
else
    ScriptLogging "Error: Password reset for $resetUser was not successful!"
    echo "Error: Password reset for $resetUser was not successful!"
    ScriptLogging "======== Aborting LAPS Update ========"
    exit 1
fi
}

# Update the LAPS Extention Attribute
UpdateJamf (){
ScriptLogging "Recording new password for $resetUser into LAPS."
# debug
# ScriptLogging "*** new pass is $newPass ***"
touch $LAPSFile

#echo "$resetUser|$newPass" > $LAPSFile
echo "$newPass" > $LAPSFile

# EA must be in Jamf to record the value
jamf recon

}

checkSecureTokenStatus () {

secureTokenStatus=$(sysadminctl -secureTokenStatus $resetUser 2>&1 | awk '{ print $7 }' | sed s'/ //g')

ScriptLogging "secure token for $resetUser is $secureTokenStatus"

}

checkIfRunBefore () {

if [ -f "$LAPSFile" ]; then
    previousPassword=$(cat $LAPSFile)
    basePassword=${previousPassword}
    # Debug
    #ScriptLogging "base password is $basePassword"

fi

}
#====================================================
# The script itself

checkSecureTokenStatus
checkIfRunBefore
RunLAPS
CheckNewPassword
UpdateJamf

ScriptLogging "======== LAPS Update Finished ========"
echo "LAPS Update Finished."

exit 0

You will also need to use this below as an Extension Attribute:

#!/bin/sh

###################################
# EA to update LAPS Password      #
###################################
udid=$(/usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, "\""); printf("%s\n", line[4]); }')
LAPSFileLocation="/usr/local/jamf/$udid/"
LAPSFile="$LAPSFileLocation.$udid"

if [[ -f "$LAPSFile" ]]; then
   value=$(cat $LAPSFile)
   echo "<result>$value</result>"
   else
   value="Not recorded"
fi

View solution in original post

perryd84 · ‎07-29-2022

I've been working on a LAPS solution for macs and have created a couple of scripts to manage the cycle of the password and account creation and an app to show the password when it's needed.

Some other LAPS for mac solutions display the admin password in plain text in Jamf which is a massive security risk. My script encrypts it all and never displays the password unless you use the decryption script which you can scope to just admin users.

I've detailed the setup on my github and the scripts are there as well.
https://github.com/PezzaD84/macOSLAPS

Check it out to see if it does what you need.

View solution in original post

rossmclaren · ‎09-17-2021

Here is the script we use:

#!/bin/sh
####################################################################################################
#
#   MIT License
#
#   Copyright (c) 2016 University of Nebraska–Lincoln
#
#	Permission is hereby granted, free of charge, to any person obtaining a copy
#   of this software and associated documentation files (the "Software"), to deal
#   in the Software without restriction, including without limitation the rights
#   to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
#   copies of the Software, and to permit persons to whom the Software is
#   furnished to do so, subject to the following conditions:
#
#   The above copyright notice and this permission notice shall be included in all
#   copies or substantial portions of the Software.
#
#   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
#   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
#   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
#   AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
#   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
#   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
#   SOFTWARE.
#
####################################################################################################
#
# HISTORY
#
#	Version: 1.4
#
#	- 04/29/2016 Created by Phil Redfern
#   - 05/01/2016 Updated by Phil Redfern, added upload verification and local Logging.
#   - 05/02/2016 Updated by Phil Redfern and John Ross, added keychain update and fixed a bug where no stored LAPS password would cause the process to hang.
#   - 05/06/2016 Updated by Phil Redfern, improved local logging and increased random passcode length.
#   - 05/11/2016 Updated by Phil Redfern, removed ambiguous characters from the password generator.
#
#   - This script will randomize the password of the specified user account and post the password to the LAPS Extention Attribute in Jamf.
#  Version 1.5
#   - 8 Sep 2020 Mark Lamont  Removed reliance on API user thus closing security hole. Now uses standard inventory function to update.
#   - Password does remain on the device though but is obscured and only available to root user.
#   - Not written to work with FileVault enabled admin users because of all the issues with secure token
#
####################################################################################################
#
# DEFINE VARIABLES & READ IN PARAMETERS
#
####################################################################################################

resetUser=""
basePassword=""
# CHECK TO SEE IF A VALUE WAS PASSED IN PARAMETER 4 AND, IF SO, ASSIGN TO "resetUser"
if [ "$4" != "" ] && [ "$resetUser" == "" ];then
resetUser=$4
fi

# CHECK TO SEE IF A VALUE WAS PASSED IN PARAMETER 5 AND, IF SO, ASSIGN TO "initialPassword"
if [ "$5" != "" ] && [ "$basePassword" == "" ];then
basePassword=$5
fi

udid=$(/usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, "\""); printf("%s\n", line[4]); }')

LogLocation="/Library/Logs/Jamf_LAPS.log"
LAPSFileLocation="/usr/local/jamf/$udid/"
if [ ! -d "$LAPSFileLocation" ]; then
mkdir -p $LAPSFileLocation
chmod 600 $LAPSFileLocation
fi

LAPSFile="$LAPSFileLocation.$udid"

newPass=$(openssl rand -base64 10 | tr -d OoIi1lLS | head -c12;echo)
####################################################################
#
#            ┌─── openssl is used to create
#            │	a random Base64 string
#            │                    ┌── remove ambiguous characters
#            │                    │
# ┌──────────┴──────────┐	  ┌───┴────────┐
# openssl rand -base64 10 | tr -d OoIi1lLS | head -c12;echo
#                                            └──────┬─────┘
#                                                   │
#             prints the first 12 characters  ──────┘
#             of the randomly generated string
#
####################################################################################################
#
# SCRIPT CONTENTS - DO NOT MODIFY BELOW THIS LINE
#
####################################################################################################

# jamf binary path
jamf_binary="/usr/local/jamf/bin/jamf"
# Logging Function for reporting actions
ScriptLogging(){

DATE=$(date +%Y-%m-%d\ %H:%M:%S)
LOG="$LogLocation"

echo "$DATE" " $1" >> $LOG
}

ScriptLogging "======== Starting LAPS Update ========"
ScriptLogging "Checking parameters."

if [ "$resetUser" == "" ];then
    ScriptLogging "Error:  The parameter 'User to Reset' is blank.  Please specify a user to reset."
    echo "Error:  The parameter 'User to Reset' is blank.  Please specify a user to reset."
    ScriptLogging "======== Aborting LAPS Update ========"
    exit 1
fi

# Verify resetUser is a local user on the computer
checkUser=$(dseditgroup -o checkmember -m $resetUser localaccounts | awk '{ print $1 }')

if [[ "$checkUser" = "yes" ]];then
    echo "$resetUser is a local user on the Computer"
else
    echo "Error: $checkUser is not a local user on the Computer!"
    ScriptLogging "======== Aborting LAPS Update ========"
    exit 1
fi

ScriptLogging "Parameters Verified."

# Update the User Password
RunLAPS (){
ScriptLogging "Running LAPS..."

if [[ "$secureTokenStatus" = "DISABLED" ]]; then

    ScriptLogging "Updating password for $resetUser."
    echo "Updating password."
    $jamf_binary resetPassword -username $resetUser -password $newPass
else
    ScriptLogging "*** Secure Token Enabled! ***"
    sysadminctl -resetPasswordFor "$resetUser" -newPassword "$newPass" -adminUser "$resetUser" -adminPassword "$basePassword"
    
    
fi

}

# Verify the new User Password
CheckNewPassword (){
ScriptLogging "Verifying new password for $resetUser."
passwdB=`dscl /Local/Default -authonly $resetUser $newPass`

if [ "$passwdB" == "" ];then
    ScriptLogging "New password for $resetUser is verified."
    echo "New password for $resetUser is verified."
else
    ScriptLogging "Error: Password reset for $resetUser was not successful!"
    echo "Error: Password reset for $resetUser was not successful!"
    ScriptLogging "======== Aborting LAPS Update ========"
    exit 1
fi
}

# Update the LAPS Extention Attribute
UpdateJamf (){
ScriptLogging "Recording new password for $resetUser into LAPS."
# debug
# ScriptLogging "*** new pass is $newPass ***"
touch $LAPSFile

#echo "$resetUser|$newPass" > $LAPSFile
echo "$newPass" > $LAPSFile

# EA must be in Jamf to record the value
jamf recon

}

checkSecureTokenStatus () {

secureTokenStatus=$(sysadminctl -secureTokenStatus $resetUser 2>&1 | awk '{ print $7 }' | sed s'/ //g')

ScriptLogging "secure token for $resetUser is $secureTokenStatus"

}

checkIfRunBefore () {

if [ -f "$LAPSFile" ]; then
    previousPassword=$(cat $LAPSFile)
    basePassword=${previousPassword}
    # Debug
    #ScriptLogging "base password is $basePassword"

fi

}
#====================================================
# The script itself

checkSecureTokenStatus
checkIfRunBefore
RunLAPS
CheckNewPassword
UpdateJamf

ScriptLogging "======== LAPS Update Finished ========"
echo "LAPS Update Finished."

exit 0

You will also need to use this below as an Extension Attribute:

#!/bin/sh

###################################
# EA to update LAPS Password      #
###################################
udid=$(/usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformUUID/ { split($0, line, "\""); printf("%s\n", line[4]); }')
LAPSFileLocation="/usr/local/jamf/$udid/"
LAPSFile="$LAPSFileLocation.$udid"

if [[ -f "$LAPSFile" ]]; then
   value=$(cat $LAPSFile)
   echo "<result>$value</result>"
   else
   value="Not recorded"
fi

LzGygoox · ‎09-29-2021

You can combine this solution with openssl enc to keep the secret safe, even if the logged user is admin.

WsIT · ‎10-10-2021

I also think that is a bit risky to store the LAPS password locally without any encryption.
Can you please elaborate on how can I encrypt it using openssl?

Thanks!

LzGygoox · ‎10-12-2021

Hi, sure!

You should first at all keep in mind that some special chars cannot be part of the password. Make some tests before implement so you can avoid issues.

You can start generating with the script, creating a temp file with the pass, then encrypt using it as input file (-in), and passing the output destination (-out), in the example bellow we are using the same location as the original script uses, but as it will be encrypted, you can select any other location. We want to encrypt the password without salt (-nosalt), as it is an easiest way to revert and, and after that we are encoding to BASE64 (-base64), I think you can avoid it (if you want), but I didn't tested it. We are removing the file to avoid keep boths, but you can keep both while testing.

LAPSTmpFile = /path/to/tmp/file
encPassword = password
echo "$newPass" > $LAPSTmpFile
openssl enc -algorithm -in $LAPSTmpFile -out $LAPSFile -nosalt -base64 -k $encPassword
rm $LAPSTmpFile

Here you have some info about openssl enc: https://www.openssl.org/docs/man1.0.2/man1/openssl-enc.html

Then, in your extension attribute you should read the file and decrypt (-d) the pass (using the same algorithm). You should do the same if you want to use the pass in policies, or other scripts.

password=$(openssl enc -algorithm -d -in $LAPSFile -nosalt -base64 -k $encPassword)

I think that it is a little bit more secure, as you can keep the file but you cannot get the admin password without encPassword.

We have some tests running, and no issues were detected yet.

WsIT · ‎10-17-2021

Thanks a lot!
I will try it today and will let you know!

bmack99 · ‎09-17-2021

Any issues with the above posted script / LAPS solution on macOS 11.x? We were pursuing implementing LAPS awhile back but saw all kinds of griping about it not working in Big Sur.

rossmclaren · ‎09-20-2021

No issues with it on Big Sur yet!

jamf_sam · ‎09-17-2021

This could be worth looking into as well: https://marketplace.jamf.com/details/easylaps/

Matt_Roy93 · ‎09-17-2021

Thank you all for the responses much appreciated!

Honestly I am not as concerned about having the local admin account be FV2 enabled and have secure tokens as it will never be actually logged into, it will only be used by support to run elevated commands and installs, if needed.

We are in the process of getting Beyond Trusts EPM solution and we could remove the existence of the local admin account and make support authenticate against our AAD service embedded with this product I am just not sure how that looks.

MacJunior · ‎05-02-2022

@rossmclaren sorry if it's a stupid question but would it be possible to tune the script to generate a password that would meet our password policy?

LzGygoox · ‎05-02-2022

@MacJuniorI think that you could add a validation function (for example) and a "apply policy" function also. So you can validate first if it accomplish your policy and if not, you can enforce it with apply policy (which maybe will add a random special char in somewhere in the string, or change few chars to uppercase, or something similar to make it compliant with your policy) 😄

perryd84 · ‎07-29-2022

I've been working on a LAPS solution for macs and have created a couple of scripts to manage the cycle of the password and account creation and an app to show the password when it's needed.

Some other LAPS for mac solutions display the admin password in plain text in Jamf which is a massive security risk. My script encrypts it all and never displays the password unless you use the decryption script which you can scope to just admin users.

I've detailed the setup on my github and the scripts are there as well.
https://github.com/PezzaD84/macOSLAPS

Check it out to see if it does what you need.

Matt_Roy93 · ‎07-29-2022

@perryd84 This is awesome work, I am excited to see if we can implement and use this effectively in our environment, Thanks!

Matt_Roy93 · ‎08-03-2022

@perryd84 I do have one probably dumb question with configuration, everything else is very straightforward and easy to setup but I am wondering what the Encrypted API credentials field under parameter 5 of the script is asking for, does this want the actual account with API access name followed by the password delimited by comma or semi-colon? OR does this want the actual bearer token information provided after basic auth takes place with username and password?

perryd84 · ‎08-04-2022

So I encrypt the API username and password and then use that encrypted string to get the bearer token from jamf. Once you have the encrypted credentials you don't need to run the encryption and can remove your plain text API details from all your scripts.

The script below will encrypt the account and then generate a token. You can take the token part and the encrypted credentials and use them in other API scripts. You only need the encode part once.

#!/bin/bash

apiuser=APIUser
apipasswd=APIPassword
url=JSSURL

# created base64-encoded credentials
encodedCredentials=$( printf "$apiuser:$apipasswd" | /usr/bin/iconv -t ISO-8859-1 | /usr/bin/base64 -i - )

echo $encodedCredentials

token=$(curl -s -H "Content-Type: application/json" -H "Authorization: Basic ${encodedCredentials}" -X POST "$url/api/v1/auth/token" | grep 'token' | tr '"' ' ' | awk '{print $3}' | xargs)

MacJunior · ‎10-16-2022

@perryd84 Can't find any scripts, did you remove it?

MacJunior · ‎10-17-2022

can you share your script again please?

perryd84 · ‎10-17-2022

Just sent you a private message👍🏻

mks007 · ‎11-21-2022

Hey @perryd84 any chance you could share your script with me?

perryd84 · ‎11-28-2022

Hi @mks007
Just need to finish the write up for the new version and I will make the repository live again.

I'll drop a message once its up👍🏻

Matt_Roy93 · ‎08-04-2022

@perryd84 this is exactly what I was looking for thank you!

Matt_Roy93 · ‎08-08-2022

@perryd84 I am still having issues, I am able to obtain the API credential via Postman but the string is too long to import to the script parameter, In this script you shared above I am not able to receive an output or understand what is being done are you willing to help elaborate? I apologize for asking so many questions :)

perryd84 · ‎08-09-2022

Hi @Matt_Roy93

No problem at all mate! Not quite sure I'm following where you are getting stuck? Which string is too long? It should be in a variable and not just posted as the string. I don't use postman as I actually find it makes things like this harder (personally) as its not really for scripting. I use coderunner to run all my scripts including API calls.

The script I've posted above is mainly just to get the bearer token. The first part is encrypting your API account the second part is using that encrypted account to get the token.

greygoose · ‎08-28-2022

Hi @Matt_Roy93

Thanks for this utility and I hope to use it soon - just a note to say I followed the steps a few times now and find that the extension attribute fields never seem to populate - what should be in showing in the LAPS secret EA ?

Also the Self Service command never reveals the unencrypted pw as a result.

I ran my creds and URL (non SS0) via your script in BBEdit and got what I think is the correct Encrypted API credentials similar to (c888888888888888888888888888888888U=) and no errors in the logs of the policy are showing

any ideas where I'm going wrong?

greygoose · ‎09-22-2022

FYI - I followed @rossmclaren script instead and all seemed ok until the macOS 12.6 update was released - now errors on every Mac I try!!

perryd84 · ‎11-29-2022

@mks007 the github repository is back up now you can check it here https://github.com/PezzaD84/macOSLAPS

caio_clemente · ‎12-15-2022

@perryd84 , good afternoon.
For me, it was not clear, which user I use in the API credential?

perryd84 · ‎12-15-2022

Hi @caio_clemente

The credentials should be your encoded api account. There is a small script in the github which can do this for you.

snowwalker1988 · a month ago

Hi @perryd84,

very nice work.

Do you have a recommendation for the rights of the API user?
This one I think don´t need full admin rights.

Do you use an extra user only for the LAPS function?

How you are build the LAPS.pkg?
The 10 seconds time is not set by a variable or?

Best regards

perryd84 · a month ago

Hi @snowwalker1988
You can find permissions for the API account here https://github.com/PezzaD84/macOSLAPS/issues/2

The LAPS account created can be an additional admin account or just replace your local admin account it's up to you. If the same account exists before the LAPS Creation runs then it will conflict with the existing account. Best practice is to have this set up a brand new account not the same as anything else already existing.

The pkg was created in Composer. You can download the LAPS.pkg from here https://github.com/PezzaD84/macOSLAPS/raw/main/LAPS.pkg

The 10 second timer is just a default timer setting in the script. It can be changed if you want by editing the --timer key followed by a custom seconds time.

Feel free to message me if you need any more help with it.

Jamf Nation Community

Mac OS LAPS