Skip to main content
Solved

Allow Standard User to remove Wi-Fi networks with prompt

  • Sep 13, 2022 3:37 PM UTC
  • 21 replies
  • 2056 views
Forum|alt.badge.img+8

We set our users to be Standard users on their Macs, and which prevents them from being able to delete Wi-Fi SSIDs. Sometimes, we've needed to allow them to do so, so we have a script in Self Service that will delete a known SSID when run.

#!/bin/sh ## Get the wireless port ID WirelessPort=$(networksetup -listallhardwareports | awk '/Wi-Fi|AirPort/{getline; print $NF}') ## Run a SSID removal if its present networksetup -removepreferredwirelessnetwork $WirelessPort "NAMEOFTHESSID" 2>/dev/null

But we've run into a situation where a work-from-home user wants to delete an SSID from their home network, etc. I was wondering if there's a way to a have a script that would allow the user to choose from existing "preferred wireless networks" SSIDs and choose which one to delete? That way, we could just have one "Remove Wi-Fi Networks" item in Self Service, and users could remove whichever one they want.

Best answer by stevewood

You can actually allow standard users to edit the wi-fi list themselves without using Self Service. If you make a change to the authorizationdb using the security binary, they can delete SSIDs themselves. These are the commands:

/usr/bin/security authorizationdb write system.preferences.network allow /usr/bin/security authorizationdb write system.services.systemconfiguration.network allow /usr/bin/security authorizationdb write com.apple.wifi allow

This was provided in this JN post:

https://community.jamf.com/t5/jamf-pro/changing-preferred-wifi-networks-without-admin-rights/m-p/139519

 

 

 

View original

    21 replies

    stevewood
    Forum|alt.badge.img+38
    • stevewood
    • Hall of Fame
    • Answer
    • Sep 13, 2022 3:58 PM UTC

    You can actually allow standard users to edit the wi-fi list themselves without using Self Service. If you make a change to the authorizationdb using the security binary, they can delete SSIDs themselves. These are the commands:

    /usr/bin/security authorizationdb write system.preferences.network allow /usr/bin/security authorizationdb write system.services.systemconfiguration.network allow /usr/bin/security authorizationdb write com.apple.wifi allow

    This was provided in this JN post:

    https://community.jamf.com/t5/jamf-pro/changing-preferred-wifi-networks-without-admin-rights/m-p/139519

     

     

     

      Forum|alt.badge.img+8

      Steve, that almost works: it unlocks the networking pane, but it seems it still requires admin credentials to remove the Wi-Fi network. A Self Service script with a prompt/dropdown list would be run as an admin through Jamf. It does work, needed the 

      /usr/bin/security authorizationdb write com.apple.wifi allow

      line. Thanks!

      markanderson
      Forum|alt.badge.img+1
      • markanderson
      • New Contributor
      • Oct 27, 2022 5:55 AM UTC

      Steps to "Allow Standard User to remove Wi-Fi networks with prompt"

      (i). Click the Start button. in the bottom left corner of the screen.
      (ii). Type "network and" and select Network and Sharing Center from the search result.
      (iii). Select Manage wireless networks.
      (iv). Select the Wi-Fi profile you want to delete then select the Remove button.
      (v). Select Yes to confirm.

      Forum|alt.badge.img+3
      • JayKay27
      • New Contributor
      • Feb 7, 2023 7:24 PM UTC

      You can actually allow standard users to edit the wi-fi list themselves without using Self Service. If you make a change to the authorizationdb using the security binary, they can delete SSIDs themselves. These are the commands:

      /usr/bin/security authorizationdb write system.preferences.network allow /usr/bin/security authorizationdb write system.services.systemconfiguration.network allow /usr/bin/security authorizationdb write com.apple.wifi allow

      This was provided in this JN post:

      https://community.jamf.com/t5/jamf-pro/changing-preferred-wifi-networks-without-admin-rights/m-p/139519

       

       

       


      Thanks for this. Do you know how to reverse this? Just change everything from allow to deny?

      Forum|alt.badge.img+7

      Anyone has a solution for MacOS Ventura? After I I performed below users are able to delete WiFi networks but they still get a prompt to fill in admin credentials. (Which is not required to remove the wifi network)

      /usr/bin/security authorizationdb write system.preferences.network allow

      /usr/bin/security authorizationdb write system.services.systemconfiguration.network allow

      /usr/bin/security authorizationdb write com.apple.wifi allow

      Forum|alt.badge.img+3
      • dancunn
      • New Contributor
      • Jul 31, 2023 4:09 PM UTC

      Anyone has a solution for MacOS Ventura? After I I performed below users are able to delete WiFi networks but they still get a prompt to fill in admin credentials. (Which is not required to remove the wifi network)

      /usr/bin/security authorizationdb write system.preferences.network allow

      /usr/bin/security authorizationdb write system.services.systemconfiguration.network allow

      /usr/bin/security authorizationdb write com.apple.wifi allow


      same experience here @Joostvantwout. on ventura, removes the network, but still gives the credential prompt and requires you to hit Cancel to get rid of the prompt because it wont accept creds since its looking for admin. im going to submit a case to jamf and see if they are able to provide any insight into doing this on ventura without getting the prompt.

      Forum|alt.badge.img+4
      • jmcmahon1
      • Contributor
      • Aug 16, 2023 6:13 PM UTC

      Anyone has a solution for MacOS Ventura? After I I performed below users are able to delete WiFi networks but they still get a prompt to fill in admin credentials. (Which is not required to remove the wifi network)

      /usr/bin/security authorizationdb write system.preferences.network allow

      /usr/bin/security authorizationdb write system.services.systemconfiguration.network allow

      /usr/bin/security authorizationdb write com.apple.wifi allow


      Getting the same thing here. macOS 13.x

      Forum|alt.badge.img+3
      • dancunn
      • New Contributor
      • Aug 16, 2023 7:42 PM UTC

      hey everyone, think ive got a solution to the ventura issue. jamf support pointed me to this discussion: https:/macadmins.slack.com/archives/C04QVP86E/p1672865513668839.

      combining that with the discussion on this thread, i was able to cobble together this script which seems to work well for allowing users to modify network settings with no prompts for creds. let me know if you folks have any luck with it or not.

      #!/bin/zsh # Variables SECURITYBIN="/usr/bin/security" PLISTBUDDYBIN="/usr/libexec/PlistBuddy" /usr/bin/security authorizationdb write system.preferences.network allow /usr/bin/security authorizationdb write system.services.systemconfiguration.network allow /usr/bin/security authorizationdb write com.apple.wifi allow /usr/libexec/airportd prefs RequireAdminNetworkChange=NO RequireAdminIBSS=NO $SECURITYBIN authorizationdb read system.preferences > /tmp/system.preferences.plist $SECURITYBIN authorizationdb read system.preferences.network > /tmp/system.preferences.network.plist # Allow access to system wide preference panes TARGETPLIST="/tmp/system.preferences.plist" ARRAY=($($PLISTBUDDYBIN -c "print :rule" $TARGETPLIST | sed -e 's/^Array {//' | sed -e 's/}//' | xargs )) #echo $ARRAY if [[ ! $ARRAY =~ '(^allow)|(\\sallow)' ]] ; then echo "Modifying $TARGETPLIST" $PLISTBUDDYBIN -c "set :class rule" $TARGETPLIST $PLISTBUDDYBIN -c "add :rule array" $TARGETPLIST $PLISTBUDDYBIN -c "add :rule: string allow" $TARGETPLIST $PLISTBUDDYBIN -c "set :shared true" $TARGETPLIST $PLISTBUDDYBIN -c "delete :authenticate-user" $TARGETPLIST $PLISTBUDDYBIN -c "delete :group" $TARGETPLIST fi # Allow access to network preference pane TARGETPLIST="/tmp/system.preferences.network.plist" ARRAY=($($PLISTBUDDYBIN -c "print :rule" $TARGETPLIST | sed -e 's/^Array {//' | sed -e 's/}//' | xargs )) #echo $ARRAY if [[ ! $ARRAY =~ '(^allow)|(\\sallow)' ]] ; then echo "Modifying $TARGETPLIST" $PLISTBUDDYBIN -c "set :class rule" $TARGETPLIST $PLISTBUDDYBIN -c "add :rule array" $TARGETPLIST $PLISTBUDDYBIN -c "add :rule: string allow" $TARGETPLIST $PLISTBUDDYBIN -c "set :shared true" $TARGETPLIST $PLISTBUDDYBIN -c "delete :authenticate-user" $TARGETPLIST $PLISTBUDDYBIN -c "delete :group" $TARGETPLIST fi $SECURITYBIN authorizationdb write system.preferences < /tmp/system.preferences.plist $SECURITYBIN authorizationdb write system.preferences.network < /tmp/system.preferences.network.plist
       
        Forum|alt.badge.img+8
        • bcrockett
        • Contributor
        • Aug 23, 2023 6:37 PM UTC

        @dancunn Your solution works in my environment! Standard users can now change network preferences. 

        M4tr1xN3o
        Forum|alt.badge.img+4
        • M4tr1xN3o
        • Contributor
        • Oct 5, 2023 11:44 AM UTC

        @dancunn's solution works for us also. Thanks!

        Forum|alt.badge.img+2
        • linknandez
        • New Contributor
        • Nov 15, 2023 11:03 PM UTC

        hey everyone, think ive got a solution to the ventura issue. jamf support pointed me to this discussion: https:/macadmins.slack.com/archives/C04QVP86E/p1672865513668839.

        combining that with the discussion on this thread, i was able to cobble together this script which seems to work well for allowing users to modify network settings with no prompts for creds. let me know if you folks have any luck with it or not.

        #!/bin/zsh # Variables SECURITYBIN="/usr/bin/security" PLISTBUDDYBIN="/usr/libexec/PlistBuddy" /usr/bin/security authorizationdb write system.preferences.network allow /usr/bin/security authorizationdb write system.services.systemconfiguration.network allow /usr/bin/security authorizationdb write com.apple.wifi allow /usr/libexec/airportd prefs RequireAdminNetworkChange=NO RequireAdminIBSS=NO $SECURITYBIN authorizationdb read system.preferences > /tmp/system.preferences.plist $SECURITYBIN authorizationdb read system.preferences.network > /tmp/system.preferences.network.plist # Allow access to system wide preference panes TARGETPLIST="/tmp/system.preferences.plist" ARRAY=($($PLISTBUDDYBIN -c "print :rule" $TARGETPLIST | sed -e 's/^Array {//' | sed -e 's/}//' | xargs )) #echo $ARRAY if [[ ! $ARRAY =~ '(^allow)|(\\sallow)' ]] ; then echo "Modifying $TARGETPLIST" $PLISTBUDDYBIN -c "set :class rule" $TARGETPLIST $PLISTBUDDYBIN -c "add :rule array" $TARGETPLIST $PLISTBUDDYBIN -c "add :rule: string allow" $TARGETPLIST $PLISTBUDDYBIN -c "set :shared true" $TARGETPLIST $PLISTBUDDYBIN -c "delete :authenticate-user" $TARGETPLIST $PLISTBUDDYBIN -c "delete :group" $TARGETPLIST fi # Allow access to network preference pane TARGETPLIST="/tmp/system.preferences.network.plist" ARRAY=($($PLISTBUDDYBIN -c "print :rule" $TARGETPLIST | sed -e 's/^Array {//' | sed -e 's/}//' | xargs )) #echo $ARRAY if [[ ! $ARRAY =~ '(^allow)|(\\sallow)' ]] ; then echo "Modifying $TARGETPLIST" $PLISTBUDDYBIN -c "set :class rule" $TARGETPLIST $PLISTBUDDYBIN -c "add :rule array" $TARGETPLIST $PLISTBUDDYBIN -c "add :rule: string allow" $TARGETPLIST $PLISTBUDDYBIN -c "set :shared true" $TARGETPLIST $PLISTBUDDYBIN -c "delete :authenticate-user" $TARGETPLIST $PLISTBUDDYBIN -c "delete :group" $TARGETPLIST fi $SECURITYBIN authorizationdb write system.preferences < /tmp/system.preferences.plist $SECURITYBIN authorizationdb write system.preferences.network < /tmp/system.preferences.network.plist
         

        Worked!! Thanks!

        Forum|alt.badge.img+3
        • dancunn
        • New Contributor
        • Nov 15, 2023 11:28 PM UTC

        Awesome, glad it's working for folks. 

        Forum|alt.badge.img+3
        • liubkkkk0
        • Contributor
        • May 13, 2024 2:59 PM UTC

        hey everyone, think ive got a solution to the ventura issue. jamf support pointed me to this discussion: https:/macadmins.slack.com/archives/C04QVP86E/p1672865513668839.

        combining that with the discussion on this thread, i was able to cobble together this script which seems to work well for allowing users to modify network settings with no prompts for creds. let me know if you folks have any luck with it or not.

        #!/bin/zsh # Variables SECURITYBIN="/usr/bin/security" PLISTBUDDYBIN="/usr/libexec/PlistBuddy" /usr/bin/security authorizationdb write system.preferences.network allow /usr/bin/security authorizationdb write system.services.systemconfiguration.network allow /usr/bin/security authorizationdb write com.apple.wifi allow /usr/libexec/airportd prefs RequireAdminNetworkChange=NO RequireAdminIBSS=NO $SECURITYBIN authorizationdb read system.preferences > /tmp/system.preferences.plist $SECURITYBIN authorizationdb read system.preferences.network > /tmp/system.preferences.network.plist # Allow access to system wide preference panes TARGETPLIST="/tmp/system.preferences.plist" ARRAY=($($PLISTBUDDYBIN -c "print :rule" $TARGETPLIST | sed -e 's/^Array {//' | sed -e 's/}//' | xargs )) #echo $ARRAY if [[ ! $ARRAY =~ '(^allow)|(\\sallow)' ]] ; then echo "Modifying $TARGETPLIST" $PLISTBUDDYBIN -c "set :class rule" $TARGETPLIST $PLISTBUDDYBIN -c "add :rule array" $TARGETPLIST $PLISTBUDDYBIN -c "add :rule: string allow" $TARGETPLIST $PLISTBUDDYBIN -c "set :shared true" $TARGETPLIST $PLISTBUDDYBIN -c "delete :authenticate-user" $TARGETPLIST $PLISTBUDDYBIN -c "delete :group" $TARGETPLIST fi # Allow access to network preference pane TARGETPLIST="/tmp/system.preferences.network.plist" ARRAY=($($PLISTBUDDYBIN -c "print :rule" $TARGETPLIST | sed -e 's/^Array {//' | sed -e 's/}//' | xargs )) #echo $ARRAY if [[ ! $ARRAY =~ '(^allow)|(\\sallow)' ]] ; then echo "Modifying $TARGETPLIST" $PLISTBUDDYBIN -c "set :class rule" $TARGETPLIST $PLISTBUDDYBIN -c "add :rule array" $TARGETPLIST $PLISTBUDDYBIN -c "add :rule: string allow" $TARGETPLIST $PLISTBUDDYBIN -c "set :shared true" $TARGETPLIST $PLISTBUDDYBIN -c "delete :authenticate-user" $TARGETPLIST $PLISTBUDDYBIN -c "delete :group" $TARGETPLIST fi $SECURITYBIN authorizationdb write system.preferences < /tmp/system.preferences.plist $SECURITYBIN authorizationdb write system.preferences.network < /tmp/system.preferences.network.plist
         

        Your script works great and really doesn't ask for the admin password when trying to "forget Wi-Fi". But I'm concerned that it might give access to all system settings to a normal user. Here is your version of the script without giving access to system.preferences. It works and when I try to "forget Wi-Fi network" I still get a request for administrator rights, despite the successful result. Do I understand correctly that if I use your script completely, I will allow an ordinary user to change EVERYTHING in the system settings?

        #!/bin/zsh

        SECURITYBIN="/usr/bin/security"
        PLISTBUDDYBIN="/usr/libexec/PlistBuddy"

        $SECURITYBIN authorizationdb write system.preferences.network allow
        $SECURITYBIN authorizationdb write system.services.systemconfiguration.network allow
        $SECURITYBIN authorizationdb write com.apple.wifi allow
        /usr/libexec/airportd prefs RequireAdminNetworkChange=NO RequireAdminIBSS=NO

        $SECURITYBIN authorizationdb read system.preferences.network > /tmp/system.preferences.network.plist

        TARGETPLIST="/tmp/system.preferences.network.plist"
        ARRAY=($($PLISTBUDDYBIN -c "print :rule" $TARGETPLIST | sed -e 's/^Array {//' | sed -e 's/}//' | xargs ))
        if [[ ! $ARRAY =~ '(^allow)|(\\sallow)' ]] ; then
        echo "Modifying $TARGETPLIST"
        $PLISTBUDDYBIN -c "set :class rule" $TARGETPLIST
        $PLISTBUDDYBIN -c "add :rule array" $TARGETPLIST
        $PLISTBUDDYBIN -c "add :rule: string allow" $TARGETPLIST
        $PLISTBUDDYBIN -c "set :shared true" $TARGETPLIST
        $PLISTBUDDYBIN -c "delete :authenticate-user" $TARGETPLIST
        $PLISTBUDDYBIN -c "delete :group" $TARGETPLIST
        fi

        $SECURITYBIN authorizationdb write system.preferences.network < /tmp/system.preferences.network.plist

         

          Forum|alt.badge.img+3
          • dancunn
          • New Contributor
          • May 13, 2024 9:30 PM UTC

          Your script works great and really doesn't ask for the admin password when trying to "forget Wi-Fi". But I'm concerned that it might give access to all system settings to a normal user. Here is your version of the script without giving access to system.preferences. It works and when I try to "forget Wi-Fi network" I still get a request for administrator rights, despite the successful result. Do I understand correctly that if I use your script completely, I will allow an ordinary user to change EVERYTHING in the system settings?

          #!/bin/zsh

          SECURITYBIN="/usr/bin/security"
          PLISTBUDDYBIN="/usr/libexec/PlistBuddy"

          $SECURITYBIN authorizationdb write system.preferences.network allow
          $SECURITYBIN authorizationdb write system.services.systemconfiguration.network allow
          $SECURITYBIN authorizationdb write com.apple.wifi allow
          /usr/libexec/airportd prefs RequireAdminNetworkChange=NO RequireAdminIBSS=NO

          $SECURITYBIN authorizationdb read system.preferences.network > /tmp/system.preferences.network.plist

          TARGETPLIST="/tmp/system.preferences.network.plist"
          ARRAY=($($PLISTBUDDYBIN -c "print :rule" $TARGETPLIST | sed -e 's/^Array {//' | sed -e 's/}//' | xargs ))
          if [[ ! $ARRAY =~ '(^allow)|(\\sallow)' ]] ; then
          echo "Modifying $TARGETPLIST"
          $PLISTBUDDYBIN -c "set :class rule" $TARGETPLIST
          $PLISTBUDDYBIN -c "add :rule array" $TARGETPLIST
          $PLISTBUDDYBIN -c "add :rule: string allow" $TARGETPLIST
          $PLISTBUDDYBIN -c "set :shared true" $TARGETPLIST
          $PLISTBUDDYBIN -c "delete :authenticate-user" $TARGETPLIST
          $PLISTBUDDYBIN -c "delete :group" $TARGETPLIST
          fi

          $SECURITYBIN authorizationdb write system.preferences.network < /tmp/system.preferences.network.plist

           


          No, this will not completely open up all of System Settings for standard users to modify. For example, most of the Privacy & Security pane (Screen Recording, Accessability, Full Disk Access, etc) will still require Admin rights to modify. 

            kwoodard
            Forum|alt.badge.img+12
            • kwoodard
            • Valued Contributor
            • Oct 15, 2024 10:53 PM UTC

            Anyone have a solution for Sonoma and Sequoia? 

            Forum|alt.badge.img+3
            • liubkkkk0
            • Contributor
            • Oct 16, 2024 6:31 AM UTC

            Anyone have a solution for Sonoma and Sequoia? 


            Solution dancunn works great for Sonoma and Sequoia

              Forum|alt.badge.img+3
              • dancunn
              • New Contributor
              • Oct 16, 2024 6:09 PM UTC

              Solution dancunn works great for Sonoma and Sequoia


              Yea did some additional testing this morning to confirm. Seems to still work as expected on Sequioa.

              kwoodard
              Forum|alt.badge.img+12
              • kwoodard
              • Valued Contributor
              • Oct 16, 2024 6:25 PM UTC

              Yea did some additional testing this morning to confirm. Seems to still work as expected on Sequioa.


              I saw a couple errors, but the script does work.

              Forum|alt.badge.img+4
              • rseeley
              • Contributor
              • Mar 11, 2025 3:52 PM UTC

              Yea did some additional testing this morning to confirm. Seems to still work as expected on Sequioa.


              Interestingly enough, I tried out the script today. Went to remove an SSID, it did remove it but then popped up the administrator prompt. I hit cancel and it stayed gone. Have you seen this?

              Forum|alt.badge.img+11
              • JevermannNG
              • Valued Contributor
              • Mar 11, 2025 4:53 PM UTC

              Interestingly enough, I tried out the script today. Went to remove an SSID, it did remove it but then popped up the administrator prompt. I hit cancel and it stayed gone. Have you seen this?


              Yes, same on my site. The Admin Prompt comes up but no input required.

              Forum|alt.badge.img+11
              • ScottEKendall
              • Valued Contributor
              • Apr 7, 2026 2:34 PM UTC

              FYI...This script still works great under Tahoe as well!

              Terms & ConditionsAccessibility statement