Randomizing the management password means that no human being actually knows the management account password on any managed Mac once thats been enabled. The JSS keeps track of it as it changes and updates the computer's record in the JSS with the new password. You will never know what it is, so I would not rely on being able to use it if you do that. That's actually a good thing. The management account should really be reserved for Casper's use exclusively, not for someone to log into or use for authentication purposes.
For that, set up a separate local admin account (preferably hidden) that you can use for times when you need local admin credentials on a Mac. Set up a strong password for it and you should be OK.
An advantage to this setup is that if someone figures out or obtains the password for that local account. you can use a policy to blow it away and create a new one with a different password, or script changing the password to something else. Having the management account separate from the regular local admin account gives you some extra options.
BTW, to actually randomize the management account password on your Macs, this is done within a policy. Create a new policy and add the Management Account payload, then from the "Action to take on computers" drop down menu, choose "Randomly generate new passwords" and set the character length you want. Set the policy frequency, like once a week, etc. and scope to all managed Macs, or just a subset if you prefer. Each day/week/month, as the Macs check in the policy will run and generate a new random password for the management account on that Mac and report it back to the JSS.
