Auto-unassign computer based on AD user account status (Active vs Inactive)

[jstine]

Hey Friends,

Has anyone successfully set up a method to auto depro a user from Jamf? I've been tasked with helping out our help desk with offloading, and I'm triyng to figure out a way to use the Jamf API to automatically remove the user assigned to the machine in Jamf.

Has anyone figured out a simple way to do this or could point me in the right direction? Admittedly my API skills are limited, any help would be greatly appreciated.

[davidacland]

Not tried it but just put this together to get you going. It needs the code to check Active/Inactive for the user in AD, but in theory, if attached to a policy to run at login, it should update the location information, clearing out whats there.

#!/bin/sh

apiUser="your_api_username"
apiPass="your_api_password"

####### Test
# some code to read users active / inactive status from AD here...

####### Advanced modification below this line #######

if [ result_of_above_test == "Inactive"]; then

# Save the local machine's serial number
serial=$(system_profiler SPHardwareDataType | grep 'Serial Number (system)' | awk '{print $NF}')

# Create the XML file to be uploaded to the JSS
cat <<EOF > /private/tmp/$serial.xml
<computer>
 <location>
   <username></username>
   <real_name></real_name>
   <email_address></email_address>
   <position></position>
   <phone></phone>
   <department></department>
   <building>Roaming</building>
   <room><room/>
  </location>
</computer>
EOF


# Read the JSS URL from the local machine
apiURL=$(defaults read /Library/Preferences/com.jamfsoftware.jamf jss_url | sed 's:/*$::')

# Update the Location section of the computer record
curl -sfku $apiUser:$apiPass $apiURL/JSSResource/computers/serialnumber/$serial/subset/location -T /private/tmp/$serial.xml -X PUT > /dev/null
    # Note - the "location" bit is a guess.  Need to check thats actually what it's called.

# Remove the saved XML file
rm /private/tmp/$serial.xml

fi

exit 0

[thoule]

Instead of using the API, you can just run recon with the -username and other parameters. see 'jamf help recon' for more info.

[davidacland]

That's was my first thought. Would it work to remove details? Would be a lot easier if it did.

[mm2270]

If I recall correctly from another thread, you can't use the jamf recon syntax to remove location information, only to assign it or update it. It won't accept a blank value I believe.

[jstine]

I've actually never used Recon. I will look into that as an option as well, thank you!