Opening up Energy Saver and Date & Time in System Preferences

[ianmb]

We have a requirement to open up the Energy Saver and Date & Time items within System Preferences so that a Standard User is able to modify these system-wide settings without entering an Administrator password, if at all possible.

I understand that this may be possible via a Configuration Profile. If so, could somebody walk me through the recommended workflow in the JSS?

[gregneagle]

This is not possible via a configuration profile. One must modify the authorization database, and this boils down to scripting.

Graham Gilbert has posted scripts that he uses with Munki, and wrote about them here: http://grahamgilbert.com/blog/2013/12/22/managing-the-authorization-database-with-munki/

Perhaps a JAMFNationer could rework these for optimal use with Casper.

[gregneagle]

Other links:

https://derflounder.wordpress.com/2014/02/16/managing-the-authorization-database-in-os-x-mavericks/
http://docs.macsysadmin.se/2012/video/Day2Session7.m4v

[ianmb]

Thanks for the pointers.

I found this discussion, and hence was able to do:

security authorizationdb write system.preferences allow security authorizationdb write system.preferences.energysaver allow

[jski]

This has been tremendously helpful thank you.

Wondering though -> is there a way to deny this access once allowed? We tested it and the allow works like a charm, but when we attempt to deny them again, we get a confirmation but the preferences still don't require admin (even after reboot).

This isn't a huge deal, but it'd be nice to know we can revoke the access if need be. Any thoughts?

This is on Yosemite btw