LPadmin and Appstore group membership? Was using login hooks...

[Mbentley777]

Hey all,

I'm wondering if there's a preferred method to ensure that all new users get added to the LPadmin and Appstore Groups? When I was using InstaDMG I was using login hooks, but if there's a more appropriate way to do it, I'd really like to migrate to the more JAMF-y way of things.

Any advice out there?

[mm2270]

A short script using 'dseditgroup' in a Once per user Login policy should work. I assume that's what you've been doing until now since you mentioned using Login Hooks.

[martin]

I use a login hook and add the user to the correct group e.g.:

OS=/usr/bin/defaults read /System/Library/CoreServices/SystemVersion ProductVersion | awk '{print substr($1,1,4)}'

# Give user permission to add the printer manually.
if [ $OS -ge 10.4 ]
then dscl . -append /Groups/_lpadmin GroupMembership $3
fi

[Mbentley777]

I haven't worked with Login policies at all - do they support the $1=current user variable?

[mm2270]

Yes, but Casper scripts use $3 for current logged in user. The process under the hood in Casper is essentially the same as if you use a loginhook to run a script. In fact, I believe its just using the jamf created loginhook to kick off the policy if I'm not mistaken.
Which reminds me, to use Login policies you need to have the Login and logout Hooks stuff enabled under "Settings > Computer Management Framework Settings", particularly the first 2 options under the main checkbox.

[daynepoirot]

Does anyone have what to put for the actual scripts or where to add this in JSS? I'm working in 8.6.2. If there's an easier way to do this please let me know, I'm just getting started with the software. Thanks