Jamf Pro admins with "View Disk Encryption Recovery Key" privilege

dan-snelson
Valued Contributor II

During a recent internal audit, we were asked to provide a list of Jamf Pro administrators who have rights to view a computer's FileVault Recovery Key.

If you have more than a few Jamf Pro admins, this task can prove tedious.

Hats off to @dacschumacher for the following SQL queries (some of which were written with extremely little real-world data).


Jamf Pro Administrators with "View Disk Encryption Recovery Key" privilege

SELECT username 
FROM   users 
WHERE  user_id IN (SELECT user_id 
                   FROM   user_roles 
                   WHERE  privilege = 'View Disk Encryption Recovery Key');

Jamf Pro Groups with "View Disk Encryption Recovery Key" privilege

SELECT group_name 
FROM   user_groups 
WHERE  group_id IN (SELECT group_id 
                    FROM   user_group_roles 
                    WHERE  privilege = 'View Disk Encryption Recovery Key');

Jamf Pro Administrators who have viewed a computer's Disk Encryption Recovery Key

(My personal favorite)

SELECT From_unixtime(ja.audit_when DIV 1000) AS 'DateStamp', 
       ja.audit_who                          AS 'User Name', 
       c.computer_name                       AS 'Computer Name', 
       ja.child_object_id                    AS 'Computer ID' 
FROM   jss_audit AS ja 
       JOIN computers AS c 
         ON c.computer_id = ja.child_object_id 
WHERE  ja.audit_what_class_name = 'FileVault2ComputerKey' 
ORDER  BY datestamp ASC;
2 REPLIES 2

donmontalvo
Esteemed Contributor III

Wow this is the kind of stuff that can benefit from its own Jamf Nation category!

API is cool and all that, but sometimes giving your DBA read only rights to MySQL is the right path.

Dan I might owe you lunch for this one!

--
https://donmontalvo.com

sdagley
Esteemed Contributor II

@dan-snelson Thank you, another incredibly useful post. While I may not need this for FV key access info, my mind is now a raging torrent, flooded with rivulets of thought cascading into a waterfall of creative alternative uses.