Skip to main content
Question

Run policy for all users except specific user?

  • September 17, 2020
  • 2 replies
  • 23 views
W
Forum|alt.badge.img+4

Just curious if anyone has had the need to do this.

I am using a LAPS like password rotation policy and I want to run this on the account our IT techs setup. However i dont want it to rotate the password until after they have completed setting up the device.

The easiest way for this, I think is to simply not run the policy if our Helpdesk account is currently logged in. If this is not possible I think I can just do an IF statement in the script with $3 to do a check for this.

Curious on peoples thoughts who are wiser than I.

    2 replies

    geoff_widdowson
    Forum|alt.badge.img+8

    I would always use a Self Service policy if I want to run it when I login then run it when I am ready.
    You can scope based on users and just add the account/s you want to be able to run the policy. You can also put users acconts in the exclusions section. You would have to have your Helpdesk account setup in Jamf. I've only done this sort of thig with a Jamf LDAP account. Not sure it would work with a standard account and a local ID on the mac.

    A
    Forum|alt.badge.img+7
    • a_stonham
    • Contributor
    • September 17, 2020

    You could add something like this to the beginning of your script.

    #!/bin/sh
consoleUser=$( /usr/bin/stat -f%Su /dev/console )

if [ "$consoleUser" == "ITADMING" ] || [ "$consoleUser" == "SOMEOTHERUSER" ]; then
    echo "Console user is: $consoleUser not rotating password"
   exit 0;
fi
    Terms & ConditionsCookie settingsAccessibility statement