To change DNS settings they need admin right. But any way, it's better to fix it via shell script
Option-1
Run script below on the target devices with an ongoing trigger. In this way, JAMF Server will apply default DNS addresses with every check-in.
-----------
#!/bin/bash
#check DNS
CurrentDNS=$(scutil --dns | grep 'nameserver*' | sort -u | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" | tr "\n" " ")
#Specify Default DNS
DefaultDNS1="192.168.1.5"
DefaultDNS2="192.168.1.5"
#Create Array for Default DNS
DefaultDNSList=(''$DefaultDNS1'' ''$DefaultDNS2'')
echo "Default DNS Addresses : ""${DefaultDNSList[@]}"
#Create Array for Current DNS
ActiveDNSList=()
ActiveDNSList+=("$CurrentDNS")
echo "Active DNS Addresses : " "${ActiveDNSList[@]}"
if [[ "${DefaultDNSList[@]}" =~ "$ActiveDNSList" ]]; then
echo "do nothing"
exit 0
else
echo "Illegal DNS"
#networksetup -setdnsservers "Wi-Fi" empty
#networksetup -setdnsservers "ethernet" empty
exit 0
fi
-----------
Option-2
If there are too many computers and if you apply with ongoing trigger, in this case you may have performance issue on JAMF so it's better to run script with launch daemon. In this way, JAMF server will deploy script and launch daemon then launch daemon automatically will run with specified time. - In my sample (every 30 minutes)
For this solution you can copy and paste script below on JAMF and apply target devices.
------------
#!/bin/bash
DNScript'#!/bin/bash
#check DNS
CurrentDNS=$(scutil --dns | grep 'nameserver*' | sort -u | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" | tr "\n" " ")
#Specify Default DNS
DefaultDNS1="192.168.1.5"
DefaultDNS2="192.168.1.5"
#Create Array for Default DNS
DefaultDNSList=(''$DefaultDNS1'' ''$DefaultDNS2'')
echo "Default DNS Addresses : ""${DefaultDNSList[@]}"
#Create Array for Current DNS
ActiveDNSList=()
ActiveDNSList+=("$CurrentDNS")
echo "Active DNS Addresses : " "${ActiveDNSList[@]}"
if [[ "${DefaultDNSList[@]}" =~ "$ActiveDNSList" ]]; then
echo "do nothing"
exit 0
else
echo "Illegal DNS"
#networksetup -setdnsservers "Wi-Fi" empty
#networksetup -setdnsservers "ethernet" empty
exit 0
fi
'
launchDaemon'<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.yourorgname.CheckDNS</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Scripts/DNSControl.sh</string>
</array>
<key>StartInterval</key>
<integer>1800</integer>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
'
tee /Library/LaunchDaemons/com.yourorgname.CheckDNS.plist << EOF
$(echo "$launchDaemon")
EOF
tee /Library/Scripts/DNSControl.sh << EOF
$(echo "$DNScript")
EOF
chmod u+x /Library/Scripts/DNSControl.sh
chown root:wheel /Library/LaunchDaemons/com.yourorgname.CheckDNS.plist
chmod 644 /Library/LaunchDaemons/com.yourorgname.CheckDNS.plist
launchctl bootstrap system /Library/LaunchDaemons/com.yourorgname.CheckDNS.plist
--------------------
If you also want warn users 😁 add line below to the if statement
/Library/Application\ Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper -icon "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/AlertStopIcon.icns" -description "Your DNS settings have been changed to default. Please do not change it again." -title "Warning" -windowType hud -button1 "OK" -lockHUD
