If the Apple Silicon Mac computers can not be enrolled through PreStage Enrollment, the Recovery Lock can only be set from remote command, here's how to do it in Jamf API.
1. First, we need to know the managementId of the target computer. we can copy it from computer‘s inventory. (Jamf Pro Server 10.50.0 and above)
2. Open the Jamf Pro Server API page (https://yourInstance.jamfcloud.com/api, or https://yourjss.domain.com:8443/api) , and choose Jamf Pro API PRODUCTION View.
3. Navigate to "MDM", and choose "POST /v2/mdm/commands", then click "Try it now".
4. Modify the request json body. Input the managementId and the recovery lock password. Set to empty ("") will remove the recovery lock password, set to a different one from previous can RESET the existed recovery lock passcode directly. (PS: Firmware/EFI passcode cannot be reset, must be removed and then set a new passcode.)
(copy paste and modify it)
{
"clientData": [
{
"managementId": "6c1c6fdd-999d-4801-ab61-8b1785cfa129",
"clientType": "COMPUTER"
}
],
"commandData": {
"commandType": "SET_RECOVERY_LOCK",
"newPassword": "12345678"
}
}
4. Click Execute.
5. The SetRecoveryLock command status can be found in computer's Management History.
That's all steps to set recovery lock passcode for one Apple Silicon computers in Jamf Pro API page. We can also set it for all Apple Silicon computers from a script.
Finally got a chance to revisit this and wanted to share: I came up with a group/policy workflow that runs automatically if Macs somehow manage to go through PreStage enrollment without Recovery Lock being enabled.
First step is the script (full credit to DerFlounder for his API token sequence):
#! /usr/bin/env zsh
# Set default exit code
exitCode=0
# Explicitly set initial value for the api_token variable to null:
api_token=""
# Explicitly set initial value for the token_expiration variable to null:
token_expiration=""
## generate random 39-digit numerical passcode
recPasscode=$(jot -r -s '' 39 0 9)
## Get the Mac's UUID string
UUID=$(ioreg -rd1 -c IOPlatformExpertDevice | awk -F'"' '/IOPlatformUUID/{print $4}')
# Set basic api access info
jamfpro_url="https://myjssserver.jamfcloud.com"
# Use the encoded credentials with Basic Authorization to request a bearer token
authToken=$(/usr/bin/curl "${jamfpro_url}/api/v1/auth/token" --silent --request POST --header "accept: application/json" --header "Authorization: Basic $4")
# Parse the returned output for the bearer token and store the bearer token as a variable.
if [[ $(/usr/bin/sw_vers -productVersion | awk -F . '{print $1}') -lt 12 ]]; then
api_token=$(/usr/bin/awk -F \" 'NR==2{print $4}' <<< "$authToken" | /usr/bin/xargs)
else
api_token=$(/usr/bin/plutil -extract token raw -o - - <<< "$authToken")
fi
# Verify that API authentication is using a valid token by running an API command
# which displays the authorization details associated with the current API user.
# The API call will only return the HTTP status code.
api_authentication_check=$(/usr/bin/curl --write-out %{http_code} --silent --output /dev/null "${jamfpro_url}/api/v1/auth" --request GET --header "Authorization: Bearer ${api_token}")
## Pull JSSID from "general" subsection
JSS_ID=$(curl -H "Accept: text/xml" -H "Authorization: Bearer ${api_token}" -sf "${jamfpro_url}/JSSResource/computers/udid/${UUID}/subset/general" | xmllint --xpath '/computer/general/id/text()' -)
## get mgmtID
mgmtID=$(curl -s -X GET "${jamfpro_url}/api/v1/computers-inventory-detail/${JSS_ID}" -H "accept: application/json" -H "Authorization: Bearer ${api_token}" | grep -i "managementid" | awk -F '"' '{print $4}')
#checkpoints for troubleshooting
#echo $api_token
#echo $api_authentication_check
#echo $JSS_ID
#echo $mgmtID
## set Recovery Lock password
curl --location --request POST "${jamfpro_url}/api/preview/mdm/commands" \
--header "Authorization: Bearer ${api_token}" \
--header 'Content-Type: application/json' \
--data-raw '{
"clientData": [
{
"managementId": "'$mgmtID'",
"clientType": "COMPUTER"
}
],
"commandData": {
"commandType": "SET_RECOVERY_LOCK",
"newPassword": "'$recPasscode'"
}
}'
## tag Mac as Recovery Lock set by API
if [[ ! -f "/usr/local/mylocalorgdir/RLapiSet" ]] && [[ $? == "0" ]]; then
touch /usr/local/mylocalorgdir/RLapiSet
fiNote that per the bearer token request, I'm using script parameters to pass along the encoded API creds.
2nd step is to create an extension attribute for the last section of the script so that computers can be detected in a smart group as having had the script's policy run:
#! /usr/bin/env zsh
if [[ -f "/usr/local/mylocalorgdir/RLapiSet" ]]; then
Result="Yes"
else
Result="No"
fi
echo "<result>$Result</result>"
Then create two smart groups - one for devices that don't have Recovery Lock enabled:
and one for those that have completed the script policy:
Finally, this will require two policies; one Ongoing policy triggered by Login and a Custom Event and scoped to both Smart Groups above:
And one triggered by check-in which runs the policy trigger for the other policy and is scoped only to the Recovery Lock not enabled group:
Appears to work beautifully - also created another smart group for Macs that might end up members of both of the above groups in order to detect ones that have had the policies run but for whatever reason haven't actually had the set Recovery Lock mgmt cmd go through.
