Beef up my Jamf pro Policie, CPs and features

[kdean]

I want to provide a better user experience in general for my users. I found a script that will gently remind the user to restart their machine every 2 weeks. I am adding that this week.

My question is:

Does anyone else have any ideas or suggestions on how I should use Jamf Pro to create a better end user experience? I do not need suggestions on the management portion. I am trying to add scripts, policies and CP's that create more features for End Users etc. All suggestions are welcomed.

[kyleblanc]

One big thing I did for my environment in the past was creating a policy to enable a temporary admin privilege to the logged in user. Depending on your env, ymmv. It really cut down on help desk tickets going to tier 1. Also creating a script to mount each users personal SMB share on login was pretty helpful. Just a couple thoughts!

[ImAMacGuy]

@kyleblanc can you share the temp admin policy/scripts/magic?
I've been trying to set something up but have a hard time getting it to work reliably.

[jared_f]

Big fan of Self Service, because most of my policies in Self Service are scoped of smart group membership, I am updating inventory every 15 minutes at check-in. Haven't seen any issues doing so. Side note, my Tomcat and MySQL are separate instances and I host my own JSS.

[kdean]

@kyleblanc lol everyone in our environment has admin privileges... that will change probably when we go through SOC2 Type 2 certification but for now the whole environment has admin rights lol... yes please share that script if you can @kyleblanc so @jwojda and I can implement this.

[scottb · Accepted solution]

@kdean -see this thread
...for some ideas that might be of use here.

[kdean]

@scottb you are the man sir!!! This is exactly what I was asking!!!

[landon_Starr]

@kyleblanc Would you mind sharing how you setup temporary admin privileges? I've played with it in the past but haven't had much luck.

[ajfunk]

Would you mind sharing how you setup temporary admin privileges? I've played with it in the past but haven't had much luck.

I second this.

[kyleblanc]

I can't take credit for something I didn't write lol but I used a modified version of this repo: https://github.com/kc9wwh/MakeMeAdminPy

It is essentially a python script that runs to make the user an admin and sets a launchdeamon to call the second script/policy to remove admin rights and perform a check to ensure compliancy (no second admin accounts were created, etc).

I also very recently stumbled onto this repo which seems to do an even better job at temp admin rights and gives the user a better visual clue: https://github.com/SAP/macOS-enterprise-privileges. I haven't been able to test this one as my env now includes all local admins (for now) lol - some notes on creating an installer for this one here

[kdean]

Ok ty @kyleblanc I actually have used https://github.com/kc9wwh/macOSUpgrade from @kc9wwh_test I should have checked out his whole library on github