Remove Local Admin Access

[scubastove]

I've been testing out a script to run the following command in Terminal:

sudo dseditgroup -o edit -d <accountname> admin

The command works fine when you put in the account name, but of course this is not ideal when there are about 100 Macs in scope. Is there any way to invoke the "current user" to be added to the line above? Ideally the script will check who is the current logged in user and remove their administrator rights. FWIW these are mobile AD accounts with local admin rights.

Thanks!

[geoff_widdowson]

You can't remove admin right while a user is logged in using a script. I use a script that will remove admin rights on all users, unless I exclude them, but I can only run the script on logout.

#!/bin/sh

adminUsers=$(dscl . -read Groups/admin GroupMembership | cut -c 18-)

for user in $adminUsers
do
    if [ "$user" != "root" ]  && [ "$user" != "Administrator" ] && [ "$user" != "administrator" ] && [ "$user" != "jss_mgmt" ] 
    then 
        dseditgroup -o edit -d $user -t user admin
        if [ $? = 0 ]; then echo "Removed user $user from admin group"; fi
    else
        echo "Admin user $user left alone"
    fi
done

[Jacek_ADC]

I am using this script and it only removes the admin rights for the logged in user while he is logged in. The hidden PreStage user account is untouched from this script and always admin

#!/bin/sh

LoggedInUser=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' )

dseditgroup -o edit -d $LoggedInUser -t user admin

Source: Solved: Re: Script to remove Admin right on MAC. - Jamf Nation Community - 260457
and Kudos to DBrowning for this script

[Jacek_ADC]

until now i do not see also some impact on the mgmt account from UIE

[Saikat]

@scubastove I use below script to demote all users to standard from admin except jamf mgmt account. Our jamf mgmt account is admin. Hence the script will demote all users except "admin"

!/bin/bash

Parameters

mgmtAccount="admin" # Required; Example: so_and_so_admin

Variables

userList=$(/usr/bin/dscl . read /Groups/admin GroupMembership | /usr/bin/cut -d " " -f 2-)

Exit out if we don't have our parameters set

[[ -z "$mgmtAccount" ]] && echo "No management account specified to ignore; exiting." && exit 1

Loop through each user and demote them, skipping root and the Jamf Pro management account specified

for userName in $userList; do if [[ "$userName" != "root" ]] && [[ "$userName" != "$mgmtAccount" ]]; then /usr/sbin/dseditgroup -o edit -d "$userName" admin echo "Account "$userName" had admin privileges removed." fi
done

exit 0

[Saikat]

@scubastove I use below script to demote all users to standard from admin except jamf mgmt account. Our jamf mgmt account is admin. Hence the script will demote all users except "admin"

!/bin/bash
Parameters
mgmtAccount="admin" # Required; Example: so_and_so_admin

Variables
userList=$(/usr/bin/dscl . read /Groups/admin GroupMembership | /usr/bin/cut -d " " -f 2-)

Exit out if we don't have our parameters set
[[ -z "$mgmtAccount" ]] && echo "No management account specified to ignore; exiting." && exit 1

Loop through each user and demote them, skipping root and the Jamf Pro management account specified
for userName in $userList; do if [[ "$userName" != "root" ]] && [[ "$userName" != "$mgmtAccount" ]]; then /usr/sbin/dseditgroup -o edit -d "$userName" admin echo "Account "$userName" had admin privileges removed." fi
done

exit 0

[ttan]

Works well.

Thanks @Saikat 

[ttan]

Correct me if I am wrong, if I change -d to -a, it should change user from standard to admin, right?

But it doesn't work. 

Any suggestions?