- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-31-2022 02:10 PM
Is it still the case that there is no way of allowing Location Services for a specific app, for non admin users? I don’t see a PPPC option for it, and it’s been stated that this is impossible in the past.
Zoom soft-phone client wants location services enabled for 911 call routing. Users don’t have admin rights.
I've seen someone say the below works for Big Sur, but even then I believe that just enables the general Apple location services, and not specifically for an app in particular.
#!/bin/sh
sudo /usr/bin/defaults write /var/db/locationd/Library/Preferences/ByHost/com.apple.locationd LocationServicesEnabled -int 1
sudo /usr/bin/defaults write /Library/Preferences/com.apple.timezone.auto Active -bool true
I need Location Services checked for Zoom specifically.
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 04-01-2022 12:37 PM
I ended up putting in a Jamf support ticket on this. Went back and forth a little, it got escalated. In the end, their final answer was that it's an intentional limitation on Apple's end that MDM's do not have the ability to do this. Pretty sure their reasoning is privacy. Which I get, but still..
I believe our network admin who is mainly doing the Zoom phone transition/integration said you can configure Zoom Phone admin settings to associate different subnets with different building locations. So if they're calling 911 with Zoom Phone on a Mac, it will look at their subnet and pull 911 location that way. This was the best we were able to do.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 03-14-2022 12:25 PM
Also in this situation for MS Teams. Would like to know if there is a solution for this.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 03-29-2022 06:48 AM
Same situation here for Zoom. Any insight into how to make this work yet?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 04-01-2022 12:37 PM
I ended up putting in a Jamf support ticket on this. Went back and forth a little, it got escalated. In the end, their final answer was that it's an intentional limitation on Apple's end that MDM's do not have the ability to do this. Pretty sure their reasoning is privacy. Which I get, but still..
I believe our network admin who is mainly doing the Zoom phone transition/integration said you can configure Zoom Phone admin settings to associate different subnets with different building locations. So if they're calling 911 with Zoom Phone on a Mac, it will look at their subnet and pull 911 location that way. This was the best we were able to do.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 04-04-2022 06:06 AM
Our MS Teams admin does the same thing. However this doesn't help the home office users, which relies on location services. The only thing I can think of is instructing the users to enable this on their own.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 04-05-2022 11:07 AM
Makes sense. We've pulled admin rights so unfortunately not an option for us :\
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 06-21-2023 09:02 AM
We actually got the same responses from Jamf/Apple when asking for better ways to do this other than "give the users admin rights and have them enable the app location manually". We had the need to enable location services for Teams (and Teams Helper) for our E911 calling. Not satisfied with those responses I dug deeper and found a way to 100% automate enabling app location services. This script is for Teams and Teams Helper, but you can review the queried file and substitute in whatever app you need (Chrome, Zoom, etc). macOS Ventura adds a GUID to the file entries so there are pre-macOS 13 and post-macOS 13 sections of the script.
First, we check if location services is enabled, if yes we continue, if not we call a different script to enable it (you will have to replace that jamf policy statement on Line 33 with the commands to enable location services listed at the beginning of this whole thread).
#!/bin/bash
####################################################################################################
# DESC: When the script runs, it will make a copy of the existing location services
# /var/db/locationd/client.plist to be used in case a revert is needed. Following, we swap 0's
# to 1's within the client.plist for Teams and Teams helper to enable them.
# REFS: N/A
#
# Author: Bill Addis
#
# HISTORY
# - v.0.0: discovery of appropriate directories and files for manipulation
# - v.1.0: initial script upload
# - v.1.1: added additional logging, as well as error checking to ensure the plist exists before manipulation
# - v.1.1: discovered+fixed a bug where if an end-user manually DISABLES Teams from using location services, the "authorized key" disappears and cannot be set
# - v.1.2: Adding an initial check at the top to see if location services for MacOS are enabled
# - v.1.3: Updated to account for changes in macOS Ventura
####################################################################################################
# Set line debugging
PS4='Line ${LINENO}: '
# Echo mount point in Jamf
echo $1
# Is location services enabled?
location_enabled=$(sudo -u "_locationd" defaults -currentHost read "/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd" LocationServicesEnabled)
if [[ "$location_enabled" = "1" ]]; then
echo ""
echo "Location Services are enabled, moving on..."
echo ""
else
echo ""
echo "Location Services disabled. Enabling them..."
# UPDATE THIS LINE TO ACTUALLY ENABLE LOCATION SERVICES
jamf policy -event location
sleep 3
location_enabled=$(sudo -u "_locationd" defaults -currentHost read "/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd" LocationServicesEnabled)
if [[ "$location_enabled" = "0" ]]; then
echo "Unable to enable location services...exiting"
exit 1
fi
fi
# Does the clients.plist exist?
echo "Current contents of /var/db/locationd directory:"
echo "$(ls /var/db/locationd)"
osVers=$(sw_vers -productVersion)
echo "macOS $osVers currently installed."
if [[ "$osVers" == *13* ]] ; then
echo "Executing for macOS Ventura..."
clients="/var/db/locationd/clients.plist"
if [[ -f "$clients" ]]; then
key1=$(/usr/libexec/PlistBuddy -c "Print" /var/db/locationd/clients.plist | grep :com.microsoft.teams | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}' | head -1)
key2=$(/usr/libexec/PlistBuddy -c "Print" /var/db/locationd/clients.plist | grep :com.microsoft.teams | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}' | tail -1)
echo "$clients already exists! Moving on..."
echo ""
echo "Current key values for teams app and teams helper:"
echo $(/usr/libexec/PlistBuddy -c "Print $key1" $clients)
echo ""
echo $(/usr/libexec/PlistBuddy -c "Print $key2" $clients)
echo ""
echo "================================="
# Create a backup of the existing client location services file
cp $clients /var/db/locationd/clients.BAK
# Create an extra working backup
cp $clients /private/var/tmp/
# Convert our working backup client plist to xml for editing
plutil -convert xml1 /private/var/tmp/clients.plist
# Use Plist Buddy to mark-up client plist, enabling Teams' location services
/usr/LibExec/PlistBuddy -c "Set :$key1:Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
echo "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :$key1:Authorized bool true" /private/var/tmp/clients.plist
echo "Adding 'authorized' key for Teams app location services returned: $?"
#/usr/LibExec/PlistBuddy -c "Set :$key1:Authorized true" /private/var/tmp/clients.plist
fi
echo "Setting Teams app location services returned: $?"
/usr/LibExec/PlistBuddy -c "Set :$key2:Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
echo "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :$key2:Authorized bool true" /private/var/tmp/clients.plist
echo "Adding 'authorized' key for Teams helper location services returned: $?"
#/usr/LibExec/PlistBuddy -c "Set :$key2:Authorized true" /private/var/tmp/clients.plist
fi
echo "Enabling Teams helper location services returned: $?"
# Convert back to binary
plutil -convert binary1 /private/var/tmp/clients.plist
# Put the updated client plist into appropriate dir
cp /private/var/tmp/clients.plist $clients
# Kill and restart the location services daemon and remove our temp file
killall locationd
rm /private/var/tmp/clients.plist
else
echo "$clients does not exist...exiting"
exit 1
fi
else
echo "Executing for macOS 12 or less..."
clients="/var/db/locationd/clients.plist"
if [[ -f "$clients" ]]; then
echo "$clients already exists! Moving on..."
echo ""
echo "Current key values for teams app and teams helper:"
echo $(/usr/libexec/PlistBuddy -c "Print :com.microsoft.teams" $clients)
echo ""
echo $(/usr/libexec/PlistBuddy -c "Print :com.microsoft.teams.helper" $clients)
echo ""
echo "================================="
# Create a backup of the existing client location services file
cp $clients /var/db/locationd/clients.BAK
# Create an extra working backup
cp $clients /private/var/tmp/
# Convert our working backup client plist to xml for editing
plutil -convert xml1 /private/var/tmp/clients.plist
# Use Plist Buddy to mark-up client plist, enabling Teams' location services
/usr/LibExec/PlistBuddy -c "Set :com.microsoft.teams:Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
echo "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :com.microsoft.teams:Authorized bool true" /private/var/tmp/clients.plist
echo "Adding 'authorized' key for Teams app location services returned: $?"
#/usr/LibExec/PlistBuddy -c "Set :com.microsoft.teams:Authorized true" /private/var/tmp/clients.plist
fi
echo "Setting Teams app location services returned: $?"
/usr/LibExec/PlistBuddy -c "Set :com.microsoft.teams.helper:Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
echo "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :com.microsoft.teams.helper:Authorized bool true" /private/var/tmp/clients.plist
echo "Adding 'authorized' key for Teams helper location services returned: $?"
#/usr/LibExec/PlistBuddy -c "Set :com.microsoft.teams.helper:Authorized true" /private/var/tmp/clients.plist
fi
echo "Enabling Teams helper location services returned: $?"
# Convert back to binary
plutil -convert binary1 /private/var/tmp/clients.plist
# Put the updated client plist into appropriate dir
cp /private/var/tmp/clients.plist $clients
# Kill and restart the location services daemon and remove our temp file
killall locationd
rm /private/var/tmp/clients.plist
else
echo "$clients does not exist...exiting"
exit 1
fi
fi
# Display the final return code
exit $?
From there, we created an extension attribute to read/report on whether or not Teams location services are enabled and just have this policy set to run this script Ongoing/Recurring Check-in/All Managed Clients (exclude smart group of machines with Teams location enabled created via the ext. attribute).
Extension attribute (we named it Teams Location Services Enabled):
#!/bin/bash
osVers=$(sw_vers -productVersion)
if [[ "$osVers" == *13* ]] ; then
key1=$(/usr/libexec/PlistBuddy -c "Print" /var/db/locationd/clients.plist | grep :com.microsoft.teams | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}' | head -1)
key2=$(/usr/libexec/PlistBuddy -c "Print" /var/db/locationd/clients.plist | grep :com.microsoft.teams | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}' | tail -1)
teamsapp_location=$(/usr/LibExec/PlistBuddy -c "Print :$key1:Authorized" /var/db/locationd/clients.plist)
teamshelper_location=$(/usr/LibExec/PlistBuddy -c "Print :$key2:Authorized" /var/db/locationd/clients.plist)
else
teamsapp_location=$(/usr/libexec/PlistBuddy -c "Print :com.microsoft.teams:Authorized" /var/db/locationd/clients.plist)
teamshelper_location=$(/usr/libexec/PlistBuddy -c "Print :com.microsoft.teams.helper:Authorized" /var/db/locationd/clients.plist)
fi
if [[ $teamshelper_location == "true" ]] && [[ $teamsapp_location == "true" ]]; then
echo "<result>true</result>"
else
echo "<result>false</result>"
fi
exit 0
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 06-28-2023 02:02 PM
How are you writing to /var/db/locationd ?
I get operation not permitted no matter the method.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 06-29-2023 02:10 PM
Are you trying to run the script via a Jamf policy? That should have full rights to do anything. If you are running the sh locally it would need sudo and probably have to give Terminal (or whatever is executing) full disk access in PPPC settings. Maybe attach a log of what you're getting and it will help. Thanks.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 07-05-2023 08:23 AM
Thank you much! I was testing out of my terminal and completely forgot about it not having Disk Access enabled for it. I rewrote the JAMF policy execution from,
jamf policy -event location
to
sudo -u "_locationd" defaults -currentHost write "/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd" LocationServicesEnabled -int 1
It appears to be working well for what we need thank you for sharing your solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 07-05-2023 08:56 AM
Great, I'm glad it was helpful to you! The location entries do not show up until the app has been opened for the first time, so we have our policy set to run Ongoing at recurring check-in for all machines (excluding machines that already have it enabled; via the extension attribute inventory). Running this just once during a build/provision probably won't work correctly since the apps will not have been opened.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-14-2023 05:05 PM
willamaddis - this is a big help as we are just having to deal with the same thing for our E911 now. EA works fine but I just can't seem to get the script to do its thing. Not sure if the name change to Teams classic and Teams Work and School require any adjustments or if it is a Sonoma thing? (with the executing for macOS 12 or less piece)
This is what I get:
Executing for macOS 12 or less... /var/db/locationd/clients.plist already exists! Moving on... Current key values for teams app and teams helper: Print: Entry, ":com.microsoft.teams2", Does Not Exist Print: Entry, ":com.microsoft.teams2.helper", Does Not Exist ================================= Set: Entry, ":com.microsoft.teams2:Authorized", Does Not Exist Authorized key seems to be missing...re-adding the key Adding 'authorized' key for Teams app location services returned: 0 Setting Teams app location services returned: 0 Set: Entry, ":com.microsoft.teams2.helper:Authorized", Does Not Exist Authorized key seems to be missing...re-adding the key Adding 'authorized' key for Teams helper location services returned: 0 Enabling Teams helper location services returned: 0
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-15-2023 04:12 AM
Actually yes, Sonoma brought about some interesting changes to the format of the plist, including adding an "i" to the beginning, lol. So its icom.microsoft.teams2, for example. I've updated the script since it was originally posted to now recursively handle all Teams instances ("classic" teams and "new" teams). The extension attribute has been updated as well to simply show the true/false values for any Teams instance on the machine so you can basically just create a smart group based on if the extension attribute contains "false" and then have the location enable script automated to run on those.
#!/bin/bash
####################################################################################################
# DESC: When the script runs, it will make a copy of the existing location services
# /var/db/locationd/client.plist to be used in case a revert is needed. Following, we swap 0's
# to 1's within the client.plist for Teams and Teams helper to enable them.
# REFS: N/A
#
# HISTORY
# - v.1.5 Bill Addis, Sep 15, 2023: Added for loop to update all Teams location entries (old Teams and new)
# - v.1.6 Bill Addis, Oct 23, 2023: Added support for Sonoma. Updated script to loop for all Teams versions
####################################################################################################
# Set line debugging
PS4='Line ${LINENO}: '
# Echo mount point in Jamf
echo $1
# Is location services enabled?
location_enabled=$(sudo -u "_locationd" defaults -currentHost read "/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd" LocationServicesEnabled)
if [[ "$location_enabled" = "1" ]]; then
echo ""
echo "Location Services are enabled, moving on..."
echo ""
else
echo ""
echo "Location Services disabled. Enabling them..."
jamf policy -event location
sleep 3
location_enabled=$(sudo -u "_locationd" defaults -currentHost read "/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd" LocationServicesEnabled)
if [[ "$location_enabled" = "0" ]]; then
echo "Unable to enable location services...exiting"
exit 1
fi
fi
# Does the clients.plist exist?
echo "Current contents of /var/db/locationd directory:"
echo "$(ls /var/db/locationd)"
osVers=$(sw_vers -productVersion)
echo "macOS $osVers currently installed."
if [[ "$osVers" == *12* ]] ; then
echo "Executing for macOS 12 Monterey..."
clients="/var/db/locationd/clients.plist"
if [[ -f "$clients" ]]; then
echo "$clients already exists! Moving on..."
echo ""
echo "Current key values for teams app and teams helper:"
echo $(/usr/libexec/PlistBuddy -c "Print :com.microsoft.teams" $clients)
echo ""
echo $(/usr/libexec/PlistBuddy -c "Print :com.microsoft.teams.helper" $clients)
echo ""
echo "================================="
# Create a backup of the existing client location services file
cp $clients /var/db/locationd/clients.BAK
# Create an extra working backup
cp $clients /private/var/tmp/
# Convert our working backup client plist to xml for editing
plutil -convert xml1 /private/var/tmp/clients.plist
# Use Plist Buddy to mark-up client plist, enabling Teams' location services
/usr/LibExec/PlistBuddy -c "Set :com.microsoft.teams:Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
echo "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :com.microsoft.teams:Authorized bool true" /private/var/tmp/clients.plist
echo "Adding 'authorized' key for Teams app location services returned: $?"
#/usr/LibExec/PlistBuddy -c "Set :com.microsoft.teams:Authorized true" /private/var/tmp/clients.plist
fi
echo "Setting Teams app location services returned: $?"
/usr/LibExec/PlistBuddy -c "Set :com.microsoft.teams.helper:Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
echo "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :com.microsoft.teams.helper:Authorized bool true" /private/var/tmp/clients.plist
echo "Adding 'authorized' key for Teams helper location services returned: $?"
#/usr/LibExec/PlistBuddy -c "Set :com.microsoft.teams.helper:Authorized true" /private/var/tmp/clients.plist
fi
echo "Enabling Teams helper location services returned: $?"
# Convert back to binary
plutil -convert binary1 /private/var/tmp/clients.plist
# Put the updated client plist into appropriate dir
cp /private/var/tmp/clients.plist $clients
# Kill and restart the location services daemon and remove our temp file
killall locationd
rm /private/var/tmp/clients.plist
else
echo "$clients does not exist...exiting"
exit 1
fi
elif [[ "$osVers" == *13* ]] ; then
echo "Executing for macOS Ventura 13 Ventura..."
clients="/var/db/locationd/clients.plist"
if [[ -f "$clients" ]]; then
echo "$clients already exists! Moving on..."
echo ""
# Create a backup of the existing client location services file
cp $clients /var/db/locationd/clients.BAK
# Create an extra working backup
cp $clients /private/var/tmp/
# Convert our working backup client plist to xml for editing
plutil -convert xml1 /private/var/tmp/clients.plist
count=1
for i in $(/usr/libexec/PlistBuddy -c "Print" /private/var/tmp/clients.plist | grep :com.microsoft.teams | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}');
do
echo "Current key value for key$count:"
echo $(/usr/libexec/PlistBuddy -c "Print $i" $clients)
# Use Plist Buddy to mark-up client plist, enabling Teams location services
/usr/LibExec/PlistBuddy -c "Set :$i:Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
echo "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :$i:Authorized bool true" /private/var/tmp/clients.plist
echo "Adding 'authorized' key for $i location services returned: $?"
fi
echo "Setting $i location services returned: $?"
echo ""
((count=count+1))
done
# Convert back to binary
plutil -convert binary1 /private/var/tmp/clients.plist
# Put the updated client plist into appropriate dir
cp /private/var/tmp/clients.plist $clients
# Kill and restart the location services daemon and remove our temp file
killall locationd
rm /private/var/tmp/clients.plist
else
echo "$clients does not exist...exiting"
exit 1
fi
elif [[ "$osVers" == *14* ]] ; then
echo "Executing for macOS 14 Sonoma..."
clients="/var/db/locationd/clients.plist"
if [[ -f "$clients" ]]; then
echo "$clients already exists! Moving on..."
echo ""
# Create a backup of the existing client location services file
cp $clients /var/db/locationd/clients.BAK
# Create an extra working backup
cp $clients /private/var/tmp/
# Convert our working backup client plist to xml for editing
plutil -convert xml1 /private/var/tmp/clients.plist
count=1
for i in $(/usr/libexec/PlistBuddy -c "Print" /private/var/tmp/clients.plist | grep -a :icom.microsoft.teams | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}' | sed "s/..$//");
do
echo "Current key value for key$count:"
echo $(/usr/libexec/PlistBuddy -c "Print $i" $clients)
# Use Plist Buddy to mark-up client plist, enabling Teams location services
/usr/LibExec/PlistBuddy -c "Set :$i\::Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
echo "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :$i\::Authorized bool true" /private/var/tmp/clients.plist
echo "Adding 'authorized' key for $i location services returned: $?"
fi
echo "Setting $i location services returned: $?"
echo ""
((count=count+1))
done
# Convert back to binary
plutil -convert binary1 /private/var/tmp/clients.plist
# Put the updated client plist into appropriate dir
cp /private/var/tmp/clients.plist $clients
# Kill and restart the location services daemon and remove our temp file
killall locationd
#rm /private/var/tmp/clients.plist
else
echo "$clients does not exist...exiting"
exit 1
fi
fi
# Display the final return code
exit $?
And here is the updated extension attribute:
#!/bin/bash
# Force the script to quit if any error encountered
set -e
osVers=$(sw_vers -productVersion)
# Initialize array variable to hold admin usernames
list=()
NL=$'\n'
if [[ "$osVers" == *13* ]] ; then
echo "Executing for macOS Ventura 13 Ventura..."
for i in $(/usr/libexec/PlistBuddy -c "Print" /var/db/locationd/clients.plist | grep :com.microsoft.teams | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}'); do
keyName=$(echo "$i" | awk -v FS=: '{print $2}')
authValue=$(/usr/LibExec/PlistBuddy -c "Print :$i:Authorized" /var/db/locationd/clients.plist)
list+=("$keyName: $authValue${NL}")
done
elif [[ "$osVers" == *14* ]] ; then
echo "Executing for macOS 14 Sonoma..."
for i in $(/usr/libexec/PlistBuddy -c "Print" /private/var/tmp/clients.plist | grep -a :icom.microsoft.teams | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}' | sed "s/..$//"); do
keyName=$(echo "$i" | awk -v FS=: '{print $2}')
authValue=$(/usr/LibExec/PlistBuddy -c "Print :$i\::Authorized" /var/db/locationd/clients.plist)
list+=("$keyName: $authValue${NL}")
done
fi
# Print all items in the list array
/bin/echo "<result>${list[@]}</result>"
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-16-2023 08:56 AM
This worked like a champ. Thank you!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-21-2023 07:38 AM
Just noticed a type in my Extension Attribute above. Here is the correct version:
#!/bin/bash
# Force the script to quit if any error encountered
set -e
osVers=$(sw_vers -productVersion)
# Initialize array variable to hold admin usernames
list=()
NL=$'\n'
if [[ "$osVers" == *13* ]] ; then
echo "Executing for macOS Ventura 13 Ventura..."
for i in $(/usr/libexec/PlistBuddy -c "Print" /var/db/locationd/clients.plist | grep :com.microsoft.teams | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}'); do
keyName=$(echo "$i" | awk -v FS=: '{print $2}')
authValue=$(/usr/LibExec/PlistBuddy -c "Print :$i:Authorized" /var/db/locationd/clients.plist)
list+=("$keyName: $authValue${NL}")
done
elif [[ "$osVers" == *14* ]] ; then
echo "Executing for macOS 14 Sonoma..."
for i in $(/usr/libexec/PlistBuddy -c "Print" /var/db/locationd/clients.plist | grep -a :icom.microsoft.teams | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}' | sed "s/..$//"); do
keyName=$(echo "$i" | awk -v FS=: '{print $2}')
authValue=$(/usr/LibExec/PlistBuddy -c "Print :$i\::Authorized" /var/db/locationd/clients.plist)
list+=("$keyName: $authValue${NL}")
done
fi
# Print all items in the list array
/bin/echo "<result>${list[@]}</result>"
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 12-06-2023 02:02 PM
Worked for me! Is there an ext. attribute for zoom? I was also able to use the script that @bmcintire posted successfully. Thank you both!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-31-2024 10:37 AM
Hi @williamaddis
Thank you for your great script and EA. a few questions:
- Do you post these on Github or anywhere else (for future updates)?
- Do you know if macOS 12 is different from macOS 13 for the EA? Currently the EA is only for macOS 13 and macOS 14.
- Just to make sure I understand correctly, version 1.6 is the latest and works for both MS Teams classic and MS Teams work or school? Will the script fail if one version (i.e. classic) is not installed?
Thank you again for your work!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 09-17-2024 01:12 PM
Hey Bill,
Is this and the accompanying script to enable Location Services for teams still the latest versions of your script?
I can't seem to get it to work on macOS 13.
Thank you.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 12-20-2023 12:05 PM
I made some quick edits to your fantastic approach just to make it more generic (in case anyone is interested in that).
Thank you very much for the effort!
#!/bin/bash
####################################################################################################
# DESC: When the script runs, it will make a copy of the existing location services
# /var/db/locationd/client.plist to be used in case a revert is needed. Following, we swap 0's
# to 1's within the client.plist for Teams and Teams helper to enable them.
# REFS: N/A
#
# Author: Bill Addis
#
# HISTORY
# - v.0.0: discovery of appropriate directories and files for manipulation
# - v.1.0: initial script upload
# - v.1.1: added additional logging, as well as error checking to ensure the plist exists before manipulation
# - v.1.1: discovered+fixed a bug where if an end-user manually DISABLES Teams from using location services, the "authorized key" disappears and cannot be set
# - v.1.2: Adding an initial check at the top to see if location services for MacOS are enabled
# - v.1.3: Updated to account for changes in macOS Ventura
# - v.1.5 Bill Addis, Sep 15, 2023: Added for loop to update all Teams location entries (old Teams and new)
# - v.1.6 Bill Addis, Oct 23, 2023: Added support for Sonoma. Updated script to loop for all Teams versions
# - v.1.7: Julian Ortega, Dec 20, 2023: Updated to work for generic apps instead of MS Teams
####################################################################################################
scriptVersion="2023.12.2"
scriptLog="${4:-"/var/log/com.jamf.appLocationServices.log"}"
appName="${5:-"Google Chrome"}"
appIdentifier="${6:-"com.google.Chrome"}"
function updateScriptLog() {
echo -e "$( date +%Y-%m-%d\ %H:%M:%S ) - ${1}" | tee -a "${scriptLog}"
}
updateScriptLog "SCRIPT VERSION: $scriptVersion"
if [[ ! -f "${scriptLog}" ]]; then
touch "${scriptLog}"
fi
# Set line debugging
PS4='Line ${LINENO}: '
# updateScriptLog mount point in Jamf
updateScriptLog $1
# Is location services enabled?
location_enabled=$(sudo -u "_locationd" defaults -currentHost read "/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd" LocationServicesEnabled)
if [[ "$location_enabled" = "1" ]]; then
updateScriptLog "Location Services are enabled, moving on..."
else
updateScriptLog "Location Services disabled. Enabling them..."
# UPDATE THIS LINE TO ACTUALLY ENABLE LOCATION SERVICES
jamf policy -event location
sleep 3
location_enabled=$(sudo -u "_locationd" defaults -currentHost read "/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd" LocationServicesEnabled)
if [[ "$location_enabled" = "0" ]]; then
updateScriptLog "Unable to enable location services...exiting"
exit 1
fi
fi
# Does the clients.plist exist?
updateScriptLog "Current contents of /var/db/locationd directory:"
updateScriptLog "$(ls /var/db/locationd)"
osVers=$(sw_vers -productVersion)
updateScriptLog "macOS $osVers currently installed."
if [[ "$osVers" == *13* ]] ; then
updateScriptLog "Executing for macOS Ventura..."
clients="/var/db/locationd/clients.plist"
if [[ -f "$clients" ]]; then
key1=$(/usr/libexec/PlistBuddy -c "Print" /var/db/locationd/clients.plist | grep :$appIdentifier | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}' | head -1)
updateScriptLog "$clients already exists! Moving on..."
updateScriptLog "Current key values for $appName app"
updateScriptLog "$(/usr/libexec/PlistBuddy -c "Print $key1" $clients)"
updateScriptLog "================================="
# Create a backup of the existing client location services file
cp $clients /var/db/locationd/clients.BAK
# Create an extra working backup
cp $clients /private/var/tmp/
# Convert our working backup client plist to xml for editing
plutil -convert xml1 /private/var/tmp/clients.plist
count=1
for i in $(/usr/libexec/PlistBuddy -c "Print" /private/var/tmp/clients.plist | grep :$appIdentifier | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}');
do
updateScriptLog "Current key value for key$count:"
updateScriptLog "$(/usr/libexec/PlistBuddy -c "Print $i" $clients)"
# Use Plist Buddy to mark-up client plist, enabling app's location services
/usr/LibExec/PlistBuddy -c "Set :$i:Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
updateScriptLog "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :$i:Authorized bool true" /private/var/tmp/clients.plist
updateScriptLog "Adding 'authorized' key for $i location services returned: $?"
fi
updateScriptLog "Setting $i location services returned: $?"
((count=count+1))
done
# Convert back to binary
plutil -convert binary1 /private/var/tmp/clients.plist
# Put the updated client plist into appropriate dir
cp /private/var/tmp/clients.plist $clients
# Kill and restart the location services daemon and remove our temp file
killall locationd
rm /private/var/tmp/clients.plist
else
updateScriptLog "$clients does not exist...exiting"
exit 1
fi
elif [[ "$osVers" == *12* ]] ; then
updateScriptLog "Executing for macOS 12 or less..."
clients="/var/db/locationd/clients.plist"
if [[ -f "$clients" ]]; then
updateScriptLog "$clients already exists! Moving on..."
updateScriptLog "Current key values for $appName app:"
updateScriptLog "$(/usr/libexec/PlistBuddy -c "Print :$appIdentifier" $clients)"
updateScriptLog "================================="
# Create a backup of the existing client location services file
cp $clients /var/db/locationd/clients.BAK
# Create an extra working backup
cp $clients /private/var/tmp/
# Convert our working backup client plist to xml for editing
plutil -convert xml1 /private/var/tmp/clients.plist
# Use Plist Buddy to mark-up client plist, enabling app's location services
/usr/LibExec/PlistBuddy -c "Set :com.$appIdentifier:Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
updateScriptLog "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :$appIdentifier:Authorized bool true" /private/var/tmp/clients.plist
updateScriptLog "Adding 'authorized' key for $appName app location services returned: $?"
#/usr/LibExec/PlistBuddy -c "Set :$appIdentifier:Authorized true" /private/var/tmp/clients.plist
fi
updateScriptLog "Setting $appName app location services returned: $?"
# Convert back to binary
plutil -convert binary1 /private/var/tmp/clients.plist
# Put the updated client plist into appropriate dir
cp /private/var/tmp/clients.plist $clients
# Kill and restart the location services daemon and remove our temp file
killall locationd
rm /private/var/tmp/clients.plist
else
updateScriptLog "$clients does not exist...exiting"
exit 1
fi
elif [[ "$osVers" == *14* ]] ; then
updateScriptLog "Executing for macOS 14 Sonoma..."
clients="/var/db/locationd/clients.plist"
if [[ -f "$clients" ]]; then
updateScriptLog "$clients already exists! Moving on..."
# Create a backup of the existing client location services file
cp $clients /var/db/locationd/clients.BAK
# Create an extra working backup
cp $clients /private/var/tmp/
# Convert our working backup client plist to xml for editing
plutil -convert xml1 /private/var/tmp/clients.plist
count=1
for i in $(/usr/libexec/PlistBuddy -c "Print" /private/var/tmp/clients.plist | grep -a :i$appIdentifier | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}' | sed "s/..$//");
do
updateScriptLog "Current key value for key$count:"
updateScriptLog "$(/usr/libexec/PlistBuddy -c "Print $i" $clients)"
# Use Plist Buddy to mark-up client plist, enabling app's location services
/usr/LibExec/PlistBuddy -c "Set :$i\::Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
updateScriptLog "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :$i\::Authorized bool true" /private/var/tmp/clients.plist
updateScriptLog "Adding 'authorized' key for $i location services returned: $?"
fi
updateScriptLog "Setting $i location services returned: $?"
((count=count+1))
done
# Convert back to binary
plutil -convert binary1 /private/var/tmp/clients.plist
# Put the updated client plist into appropriate dir
cp /private/var/tmp/clients.plist $clients
# Kill and restart the location services daemon and remove our temp file
killall locationd
#rm /private/var/tmp/clients.plist
else
updateScriptLog "$clients does not exist...exiting"
exit 1
fi
fi
# Display the final return code
exit $?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-16-2023 06:42 AM
I modified it to authorize Zoom instead of Teams, but the issue is in 14.2 it appears it won't let you write to that directory. Manually or via Jamf.
Location Services are enabled, moving on...
Current contents of /var/db/locationd directory:
CLDaemonMonitor
Library
clients.plist
macOS 14.2 currently installed.
Executing for macOS 14 Sonoma...
/var/db/locationd/clients.plist already exists! Moving on...
cp: /var/db/locationd/clients.BAK: Operation not permitted
Current key value for key1:
Print: Entry, "291BDDC9-1508-47C4-B2E9-EEB42B92BDB6\:ius.zoom.xos", Does Not Exist
Setting 291BDDC9-1508-47C4-B2E9-EEB42B92BDB6\:ius.zoom.xos location services returned: 0
cp: /var/db/locationd/clients.plist: Operation not permitted
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-16-2023 07:08 AM
Can you send the text of what that Zoom data looks like in that clients.plist file? So you are testing this on a beta version of 14.2?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-16-2023 07:13 AM
Beta 3 of 14.2. So could be a bug but knowing Apple...things to come.
"291BDDC9-1508-47C4-B2E9-EEB42B92BDB6:ius.zoom.xos:" = {
Authorized = 0;
BundleId = "us.zoom.xos";
BundlePath = "/Applications/zoom.us.app";
ClientStorageToken = {length = 32, bytes = 0x956d5c05 24e7b867 84bc0627 525832d2 ... 55274884 7855e965 };
Executable = "/Applications/zoom.us.app/Contents/MacOS/zoom.us";
LocationTimeStopped = "721830478.259725";
PluginBundleIds = (
);
ReceivingLocationInformationTimeStopped = "721830472.978381";
Registered = 1;
Requirement = "identifier \\"us.zoom.xos\\" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = BJ4HAAB9B3";
};
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-16-2023 07:28 AM
Are you able to check the temp copy of the plist where all the edits are made to see if its setting the Authorized value to 1 for that Zoom key (/private/var/tmp/clients.plist). I just checked on one of mine Sonoma machines (only 14.1.1) and I do see similar "Print Entry.... does not exist" but that is because its interpreting that \ literally in the uuid\:icom.app.... rather than just the : in between, so I can do some refinement there, but the settings all still apply properly. It just needs the terminated value to properly set the key, but doesn't need it for the display. Such a pain. This should all be something done as easy as every other PPPC setting on a supervised machine :)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-16-2023 07:34 AM
Actually still showing false. But won't write the backup or write over the original in that directory.
<key>291BDDC9-1508-47C4-B2E9-EEB42B92BDB6:ius.zoom.xos:</key>
<dict>
<key>Authorized</key>
<false/>
<key>BundleId</key>
<string>us.zoom.xos</string>
<key>BundlePath</key>
<string>/Applications/zoom.us.app</string>
<key>ClientStorageToken</key>
<data>
lW1cBSTnuGeEvAYnUlgy0jRv8sLRTx6yVSdIhHhV6WU=
</data>
<key>Executable</key>
<string>/Applications/zoom.us.app/Contents/MacOS/zoom.us</string>
<key>LocationTimeStopped</key>
<real>721830478.25972497</real>
<key>PluginBundleIds</key>
<array/>
<key>ReceivingLocationInformationTimeStopped</key>
<real>721830472.97838104</real>
<key>Registered</key>
<true/>
<key>Requirement</key>
<string>identifier "us.zoom.xos" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = BJ4HAAB9B3</string>
</dict>
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-16-2023 09:40 AM
Can you put the updated code in here, basically the for loop with the plist/grep commands through the Add Authorized.. section is what I was looking to see. Maybe something will stand out.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-17-2023 11:05 AM
#!/bin/bash
####################################################################################################
# DESC: When the script runs, it will make a copy of the existing location services
# /var/db/locationd/client.plist to be used in case a revert is needed. Following, we swap 0's
# to 1's within the client.plist for Zoom and Zoom helper to enable them.
# REFS: N/A
#
# HISTORY
# - v.1.5 Bill Addis, Sep 15, 2023: Added for loop to update all Zoom location entries (old Zoom and new)
# - v.1.6 Bill Addis, Oct 23, 2023: Added support for Sonoma. Updated script to loop for all Zoom versions
####################################################################################################
# Set line debugging
PS4='Line ${LINENO}: '
# Echo mount point in Jamf
echo $1
# Is location services enabled?
location_enabled=$(sudo -u "_locationd" defaults -currentHost read "/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd" LocationServicesEnabled)
if [[ "$location_enabled" = "1" ]]; then
echo ""
echo "Location Services are enabled, moving on..."
echo ""
else
echo ""
echo "Location Services disabled. Enabling them..."
jamf policy -event location
sleep 3
location_enabled=$(sudo -u "_locationd" defaults -currentHost read "/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd" LocationServicesEnabled)
if [[ "$location_enabled" = "0" ]]; then
echo "Unable to enable location services...exiting"
exit 1
fi
fi
# Does the clients.plist exist?
echo "Current contents of /var/db/locationd directory:"
echo "$(ls /var/db/locationd)"
osVers=$(sw_vers -productVersion)
echo "macOS $osVers currently installed."
if [[ "$osVers" == *12* ]] ; then
echo "Executing for macOS 12 Monterey..."
clients="/var/db/locationd/clients.plist"
if [[ -f "$clients" ]]; then
echo "$clients already exists! Moving on..."
echo ""
echo "Current key values for Zoom app and Zoom helper:"
echo $(/usr/libexec/PlistBuddy -c "Print :us.zoom.xos" $clients)
echo ""
echo $(/usr/libexec/PlistBuddy -c "Print :us.zoom.xos.helper" $clients)
echo ""
echo "================================="
# Create a backup of the existing client location services file
sudo cp $clients /var/db/locationd/clients.BAK
# Create an extra working backup
sudo cp $clients /private/var/tmp/
# Convert our working backup client plist to xml for editing
plutil -convert xml1 /private/var/tmp/clients.plist
# Use Plist Buddy to mark-up client plist, enabling Zoom' location services
/usr/LibExec/PlistBuddy -c "Set :us.zoom.xos:Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
echo "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :us.zoom.xos:Authorized bool true" /private/var/tmp/clients.plist
echo "Adding 'authorized' key for Zoom app location services returned: $?"
#/usr/LibExec/PlistBuddy -c "Set :us.zoom.xos:Authorized true" /private/var/tmp/clients.plist
fi
echo "Setting Zoom app location services returned: $?"
/usr/LibExec/PlistBuddy -c "Set :us.zoom.xos.helper:Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
echo "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :us.zoom.xos.helper:Authorized bool true" /private/var/tmp/clients.plist
echo "Adding 'authorized' key for Zoom helper location services returned: $?"
#/usr/LibExec/PlistBuddy -c "Set :us.zoom.xos.helper:Authorized true" /private/var/tmp/clients.plist
fi
echo "Enabling Zoom helper location services returned: $?"
# Convert back to binary
plutil -convert binary1 /private/var/tmp/clients.plist
# Put the updated client plist into appropriate dir
sudo cp /private/var/tmp/clients.plist $clients
# Kill and restart the location services daemon and remove our temp file
killall locationd
rm /private/var/tmp/clients.plist
else
echo "$clients does not exist...exiting"
exit 1
fi
elif [[ "$osVers" == *13* ]] ; then
echo "Executing for macOS Ventura 13 Ventura..."
clients="/var/db/locationd/clients.plist"
if [[ -f "$clients" ]]; then
echo "$clients already exists! Moving on..."
echo ""
# Create a backup of the existing client location services file
sudo cp $clients /var/db/locationd/clients.BAK
# Create an extra working backup
sudo cp $clients /private/var/tmp/
# Convert our working backup client plist to xml for editing
plutil -convert xml1 /private/var/tmp/clients.plist
count=1
for i in $(/usr/libexec/PlistBuddy -c "Print" /private/var/tmp/clients.plist | grep :us.zoom.xos | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}');
do
echo "Current key value for key$count:"
echo $(/usr/libexec/PlistBuddy -c "Print $i" $clients)
# Use Plist Buddy to mark-up client plist, enabling Zoom location services
/usr/LibExec/PlistBuddy -c "Set :$i:Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
echo "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :$i:Authorized bool true" /private/var/tmp/clients.plist
echo "Adding 'authorized' key for $i location services returned: $?"
fi
echo "Setting $i location services returned: $?"
echo ""
((count=count+1))
done
# Convert back to binary
plutil -convert binary1 /private/var/tmp/clients.plist
# Put the updated client plist into appropriate dir
sudo cp /private/var/tmp/clients.plist $clients
# Kill and restart the location services daemon and remove our temp file
killall locationd
rm /private/var/tmp/clients.plist
else
echo "$clients does not exist...exiting"
exit 1
fi
elif [[ "$osVers" == *14* ]] ; then
echo "Executing for macOS 14 Sonoma..."
clients="/var/db/locationd/clients.plist"
if [[ -f "$clients" ]]; then
echo "$clients already exists! Moving on..."
echo ""
# Create a backup of the existing client location services file
sudo cp $clients /var/db/locationd/clients.BAK
# Create an extra working backup
sudo cp $clients /private/var/tmp/
# Convert our working backup client plist to xml for editing
plutil -convert xml1 /private/var/tmp/clients.plist
count=1
for i in $(/usr/libexec/PlistBuddy -c "Print" /private/var/tmp/clients.plist | grep -a :ius.zoom.xos | awk -F '=Dict{' '{gsub(/ /,"");gsub(":","\\:");print $1}' | sed "s/..$//");
do
echo "Current key value for key$count:"
echo $(/usr/libexec/PlistBuddy -c "Print $i" $clients)
# Use Plist Buddy to mark-up client plist, enabling Zoom location services
/usr/LibExec/PlistBuddy -c "Set :$i\::Authorized true" /private/var/tmp/clients.plist
# Check return for last command
if [[ "$?" = "1" ]]; then
echo "Authorized key seems to be missing...re-adding the key"
/usr/LibExec/PlistBuddy -c "Add :$i\::Authorized bool true" /private/var/tmp/clients.plist
echo "Adding 'authorized' key for $i location services returned: $?"
fi
echo "Setting $i location services returned: $?"
echo ""
((count=count+1))
done
# Convert back to binary
plutil -convert binary1 /private/var/tmp/clients.plist
# Put the updated client plist into appropriate dir
sudo cp /private/var/tmp/clients.plist $clients
# Kill and restart the location services daemon and remove our temp file
killall locationd
#rm /private/var/tmp/clients.plist
else
echo "$clients does not exist...exiting"
exit 1
fi
fi
# Display the final return code
exit $?
Could be way off base here, but it really doesn't like writing to that directory. Haven't tested on a lower OS.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-17-2023 11:32 AM
I've tested all the way up to Sonoma 14.1.1 and it works just fine. Just make sure that whatever is running the script has Full Disk Access granted. If that is Jamf it should have it automatically (as long as you have the proper boxes checked in Settings/Computer Management/Security to automatically install the PPPC profiles). If you are testing it in Terminal or CodeRunner or something, you'll have to go add the app to Full Disk Access.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 11-21-2023 07:31 AM
FYI, I finally got around to testing this on 14.2 beta 3 and it still works just fine. Can you send me a URL to the Zoom installer you are using? I can install it and hopefully figure out where you are running into issues. Thanks!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 12-14-2023 10:10 AM
I recently got this working for Zoom. Many thanks to @williamaddis and @bmcintire for doing the heavy lifting. It saved me a ton of time.
I'll confirm that this only works if Zoom is installed via the IT Admin installer: https://amherstcollege.zoom.us/client/5.16.10.25689/ZoomInstallerIT.pkg if Zoom was installed using the standard Zoom client, I saw the same behavior that @bmcintire was reporting. I only tested up to macOS 14.1.2 though so I suppose there could be an additional issue with 14.2+
Simply writing over the original Zoom client with the ZoomInstallerIT.pkg seems to solve the problem, no need to uninstall first.
- Chris
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 12-14-2023 10:51 AM
Awesome, thanks for the update. Glad it was helpful!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 12-29-2023 10:36 AM
I've managed to get a script going: should work to allow user to hit the Toggle for Zoom specifically to allow location services. I am stuck trying to piece it all together if there are any ideas?
#!/bin/bash
## Unload locationd
launchctl unload /System/Library/LaunchDaemons/com.apple.locationd.plist
## Write enabled value to locationd plist
sudo /usr/bin/defaults write /var/db/locationd/Library/Preferences/ByHost/com.apple.locationd LocationServicesEnabled -int 1
## Fix Permissions for the locationd folder
chown -R _locationd:_locationd /var/db/locationd
## Reload locationd
launchctl load /System/Library/LaunchDaemons/com.apple.locationd.plist
exit 0
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-04-2024 07:55 AM
On a Sonoma 14.2.1 Mac I am getting the following error, I see some others have seen this error too, anyone have a solution?
cp: /var/db/locationd/clients.plist: Operation not permitted
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-31-2024 11:56 AM
Just to be sure, are you running the script via Jamf and getting this error or are you running it locally with sudo?
I believe you have to run it through Jamf which runs as root, or give full disk access permission to Terminal as a workaround for running it locally.
I ran @williamaddis original script for Teams via Jamf and no issues. Same with the EA he has for it, when run through Jamf the data populates properly.
I am on macOS 14.3, M3 Max.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 04-05-2024 09:51 AM
I've created a feature request to ask for this kind of auditing to be added
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 04-05-2024 10:17 AM
This script can be repurposed for Zoom as well to force auto-enable location for the app, and the Extension attribute can also be tweaked to provide you inventory data on whether its enabled or not. You would just have to update the proper value from /var/db/locationd/clients.plist related to Zoom.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 04-05-2024 11:31 AM
I've been trying to use it, tweaked for Zoom and I've found the code for Sonoma doesn't work at all, it seems to only work for some clients on Ventura, and I have older versions of macOS I have to support as well. So while I'm working on tweaking this to see if I can get it working in my environment (and if I can I'm happy to post it here) asking for Jamf to add support for this seems like a reasonable thing to do.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 04-05-2024 12:48 PM
@GeorgeCasper what issues are you seeing with Sonoma?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 04-08-2024 07:19 AM
It never returns anything; if I run the script manually it detects the OS correctly but never generates any other output other than empty <result> tags.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 04-08-2024 07:34 AM
How are you trying to call the script manually? If you're using Terminal you'd need to grant it FDA.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 04-08-2024 08:14 AM
Yes, via a script I'm invoking in terminal. Terminal has the access needed. I get "Entry blahblahblah:ius.zoom.us", Does Not Exist when it does exist (as evidenced by running /$path/PListBuddy "Print" /$otherpath/clients.plist)
I've decided to view this as an opportunity to learn some python (rather than play games with grep/awk/sed), so don't worry about it.