JAMF LAPS Tools

[perryd84]

Hi all,

I've done a lot of work on creating a LAPS tool of my own which can be found here https://github.com/PezzaD84/macOSLAPS

But with the release of 10.49 the JAMF LAPS solution is looking a lot better than initially. So I have created a couple of tools to help configure the LAPS settings and view the LAPS account and password.

Check them out here:
LAPS Configurator tool - https://github.com/PezzaD84/JAMFLAPS-Configurator
View LAPS Credentials - https://github.com/PezzaD84/JAMF-LAPS-UI

Please note these are very early release so there will be changes to come!

All feedback is welcome😁

[mm2270]

I took a look at this. It's good work, thanks for putting it together.

But one piece of advice. You should mention in your notes on github that the solution specifically uses swiftDialog for the UI. I see in your script you have a section where it downloads the latest version of swiftDialog if needed, but you can't assume every environment will be able to do this. For example, I work at a bank, and so, highly regulated environment. Github is blocked for many users (I have access to it, and so do some others), and also we use an authenticated web proxy, for which github is not one of the excluded sites, so all curl commands must be preceded with a --proxy <proxyaddress> string for curl to work at all.

Just some things to think about. As it is, for some people your solution may not work since they may not be able to auto download swiftDialog if it needs to do that. They can always pre-deploy swiftDialog of course to meet that requirement. If it's mentioned in your notes, others will know what they need to do to get it to work.

[jamf-42]

great point.. with how things are with supply chain attacks.. we don't allow any remote ingest of code or pkg or ..anything ... not matter where or who.. (and im surprised some people think this is acceptable) 

@perryd84 great work though.. I've done a code review all all good.. now to have some time to test.

my only other take is jamf will roll a GUI for this pretty soon ( maybe ) so.. keep that in mind on your dev time on this.. 😎

[perryd84]

Lol I'm expecting a gui interface anytime soon so I'm sure to slack off with the development in time. But for now this at least makes using jamf laps a little nicer and more user friendly for some admins.

[perryd84]

Thanks for the feedback.

As stated it's very early release and I guess if admins in highly restricted environments need to use apps like swift dialog then these can be pre-deployed in a secure way and the scripts can be tweaked.

The notes on the GitHub pages are very basic at the moment as it is in a very early version and I haven't had a chance to detail every aspect on GitHub yet.

Hopefully the tools were of some use at least regardless of the security hurdles?

[jamf-42]

much appreciated.. and once tested ill use in live.. I just wish I had the spare time to dev things... 

[mm2270]

Yes, all good. You saved me from doing some of this work myself. I've had it on my "to-do" list since Jamf introduced this new LAPS solution. I may make a few modifications to it to fit my environment.

[perryd84]

Nice one! Let me know of any changes you make and any additions, I'm always open to new ways of doing things 👍🏻

[ArthurKellogg]

Thanks for sharing it with us, I really like the LAPS Configurator tool.

[perryd84]

Thanks for the feedback glad its come of some use to you 😁

[perryd84]

So after my session at JNUC I've had a lot of great feedback and have now taken some of these points to action. I've now updated my main LAPS solution with a lot of new features which can be found here. https://github.com/PezzaD84/macOSLAPS

Also my JAMF LAPS UI has been updated too with these new features that were requested from JNUC. You can find that here https://github.com/PezzaD84/JAMF-LAPS-UI

 Keep the feedback coming it's really helpful when building these tools.

[jobscommasteve]

My noob question for this is, will this impact the existing prestage-configured admin account(s)? 

[perryd84]

@jobscommasteve my LAPS solution doesn't touch existing accounts or the JAMF management accounts. JAMF LAPS however will take control of your Pre-stage and user initiated management accounts. By default since 11.3 JAMF LAPS is enabled by default on user enrolled devices.