Auto-unassign computer based on AD user account status (Active vs Inactive)

Not tried it but just put this together to get you going. It needs the code to check Active/Inactive for the user in AD, but in theory, if attached to a policy to run at login, it should update the location information, clearing out whats there.

1#!/bin/sh
2
3apiUser="your_api_username"
4apiPass="your_api_password"
5
6####### Test
7# some code to read users active / inactive status from AD here...
8
9####### Advanced modification below this line #######
10
11if [ result_of_above_test == "Inactive"]; then
12
13# Save the local machine's serial number
14serial=$(system_profiler SPHardwareDataType | grep 'Serial Number (system)' | awk '{print $NF}')
15
16# Create the XML file to be uploaded to the JSS
17cat <<EOF > /private/tmp/$serial.xml
18<computer>
19 <location>
20   <username></username>
21   <real_name></real_name>
22   <email_address></email_address>
23   <position></position>
24   <phone></phone>
25   <department></department>
26   <building>Roaming</building>
27   <room><room/>
28  </location>
29</computer>
30EOF
31
32
33# Read the JSS URL from the local machine
34apiURL=$(defaults read /Library/Preferences/com.jamfsoftware.jamf jss_url | sed 's:/*$::')
35
36# Update the Location section of the computer record
37curl -sfku $apiUser:$apiPass $apiURL/JSSResource/computers/serialnumber/$serial/subset/location -T /private/tmp/$serial.xml -X PUT > /dev/null
38    # Note - the "location" bit is a guess.  Need to check thats actually what it's called.
39
40# Remove the saved XML file
41rm /private/tmp/$serial.xml
42
43fi
44
45exit 0

Instead of using the API, you can just run recon with the -username and other parameters. see 'jamf help recon' for more info.

That's was my first thought. Would it work to remove details? Would be a lot easier if it did.

If I recall correctly from another thread, you can't use the jamf recon syntax to remove location information, only to assign it or update it. It won't accept a blank value I believe.

I've actually never used Recon. I will look into that as an option as well, thank you!