standard user recon

[acdesigntech]

Hi everyone, I have a need to run recon as a standard user. However standard user accounts do not have permissions to list software updates, and so the softwareupdate -l process hangs, waiting for admin credentials. This is crappy when you are running a recon behind a FS jamfHelper window. Is there a way to force recon to skip the softwareupdate -l, or only recon for EAs, or something?

Currently I'm doing this with Applescript:

set completionTime to (current date)
do shell script "mkfile -n 4k /Users/Shared/Completion.txt; chmod 777 /Users/Shared/Completion.txt"
do shell script "echo " & shortName & "-" & completionTime & " >> /Users/Shared/Completion.txt"
do shell script "jamf recon > /dev/null 2>&1 &"
set SWUPID to do shell script "ps -ax | grep -v grep | grep softwareupdate | awk '{print $1}'"
set LoopCount to 1
repeat until SWUPID is not equal to "" or LoopCount is 7
    set LoopCount to LoopCount + 1
    delay 60
    set SWUPID to do shell script "ps -ax | grep -v grep | grep softwareupdate | awk '{print $1}'"
end repeat
do shell script "killall softwareupdate"

set jamfHelperPID to do shell script "ps -ax | grep -v grep | grep jamfHelper | awk '{print $1}'"
if jamfHelperPID is not equal to "" then
    do shell script "killall jamfHelper"
end if
do shell script "killall 'System Events'"

For whatever reason this loop fails about half the time and the fs window just sits there till I kill it. Management wants to know when the outlook migration process on a mac is completed, so I have a text file being written to /Users/Shared on completion, then running a recon to get the EA to show in the JSS. Since the AS has to run in the user context, the recon also runs in the user context.

[chris_kemp]

Are you just concerned with the text file in /Users/Shared? If so, there isn't really a reason to run Recon as the current user. All users should have access to the directory contents.

Is this something that the end user is running themselves?

[mm2270]

Curious as to why you think this needs to run as an Applescript? Looking through it, its almost all shell commands. No real user interaction that I can see, so why not just make this a shell script? Or is it an AS because users are double clicking it as Chris suggests?

[acdesigntech]

Its an auto setup script for outlook 2011, doubles as a migration script for anyone that had data in Entourage. It runs on first launch of outlook.

The reason for recon is so I can pull a report in the JSS of the extension attribute for "when a mac completed migration" based on this text file. All users do have access to this file, but I need to get it into the JSS. I could always just force a recon periodically throughout the day via remote or policy, but my management wants a more "real time" esque report. Though it's quickly becoming more hassle than its worth, I might go the route of periodically pulling reports rather than trying to ram it into the AS.

[chris_kemp]

Seems like an ideal candidate for a Self Service policy to me - have the user run the Policy which would:

1. Install Outlook 2011
2. Migrate their User Data (via your script)
3. Recon the machine

Would that take care of the issue?