I would like to have an option for certain enrolled users to be able to restore their admin privileges without a restriction (time, etc). I removed the timer lines in the above script, as the prompt was a nice user notification, but it seemed to revert to a standard account within a few minutes.
Also, for extended periods of admin requests, such as 1 month, 6 months, 1 year, is there a recommended way to assign those in jamf, perhaps not based on AD group details.
If your attempting to do something along these lines, to allow kids to do something specific with admin rights, it would be suggested to revoke access to the user and accounts preferences menu item, and terminal, as they will generate their own admin accounts while they have admin rights.
This is not in an educational environment, but if users do create additional accounts while circumventing our policies or abusing admin privileges that's no longer an IT problem.
I was able to test the following script to grant full admin rights back to the user:
#!/bin/sh # define jamfhelper location jhelp="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper" # dseditgroup to promote the currently logged in user to admin rights if [[ `/usr/bin/dscl . read /Groups/admin GroupMembership | /usr/bin/grep -c $3` == 1 ]] then /bin/echo "$3 is in the admin group, exiting" exit 0 else /bin/echo "$3 is not an admin, promoting.." fi /usr/sbin/dseditgroup -o edit -a $3 -t user admin "$jhelp" -windowType utility -title "User Admin Privileges" -description "Admin privileges restored." -button1 "OK"
However I do notice if i use
MakeMeAdmin and set the timer for 60 minutes, and the user requires a restart during their use or installation, it reverts back to the standard account. Is this expected behavior?