We are looking for a script that we can run to check to see if our local admin account is already setup in OSX. If it is, exit. If it is not, then create the local admin account. Does any one have a script that currently does that? I know we can use the JAMF binary as well as smartgroups with a policy, but it this situation, we would like to do it via a script. Most script I find only create an account but not check to see if it exists first. Thanks in advance for any guidance you can offer.
Remember to specify a language when asking about scripts. Some bash examples:
Clearer, but more error prone:
#!/bin/bash if [[ $(dscl . list /Users) =~ "shortusername" ]]; then # do stuff else # create user fi
The problem is that a user named groot will match a search for a user named root, lpadmin will match a search for a user named admin, etc.
Cryptic, but a better test:
#!/bin/bash dscl . read /Users/shortusername && echo do stuff || echo create user
Or in other words, if you can read a record for this exact user name, do stuff. If not, create the user.
I'd recommend using an extension attribute to check if the user exists. Then scope a smart group to that attribute. You can then use @dwandro92 suggestion in a policy that's scoped to that smart group to create the user.
Example extension attribute:
#!/bin/bash result="`dscl . -list /Users |grep ladmin`" if [ "$result" != "" ]; then echo "<result>Yes</result>" else echo "<result>No</result>" fi exit 0
If this is time insensitive enough to use an extension attribute, you wouldn't actually need one. Just create a smart group with criteria of Local User Accounts has "shortusername". Also, if using grep to parse dscl output, add regex anchors to avoid the problem I mentioned earlier with partial user name matches.
One thing I noticed is that the built-in smart group criteria wasn't detecting two 'hidden' user accounts that we have on our machines (our local admin deployed via Jamf Pro, and one from Mosyle, which devices migrated to Jamf Pro still have).