Self Service After DEP Enrollment

I would run a series of checks to ensure that a real user is logged on and not _mbsetupuser. It's worth noting that there's a known product issue (PI-004144) with the enrollmentComplete trigger that some folks are reporting. I see this in my own development instances running Jamf Pro 10 in the jamf.log files.

Fri Nov 03 09:32:32 it-67890 jamf[1377]: Network state changed, checking for policies...
Fri Nov 03 09:32:32 it-67890 jamf[1377]: Network state changed, checking for policies...

You may have to get creative like others have but if you decide to run the checks, I'd recommend something like this.

# While-loop used to detect if a standard user is logged on

while true
do
    loggedinuser=$(/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }')
    if [ "$loggedinuser" = "root" ] || [ "$loggedinuser" = "_mbsetupuser" ] || [ "$loggedinuser" = "loginwindow" ]; then
        sleep 10
    else
        break
    fi
done

Once you exit the while-loop, insert your command. Hope that helps :)