Time and Date correction when end-user do not have admin rights

[Bernard_Huang]

Hi all,

Wonder if any Mac admins out here have experienced this.

Here's the scenario:
- A Macbook has run out of battery, for whatever reason. The Macbook clock would have reset itself to it's basic time, which is year 01/01/2017 (we are currently Jun 2019).
- The end user do not have admin rights, therefore cannot change the date and time.
- From JAMF Pro, I tried to setup a policy/script to connect it to our company's time server, so it will get the correct date and time again.
- But, having the date and time 2 or more years different, JAMF Pro can't communicate with this Macbook, and therefore nothing happens.
- The only work around is to get a local-admin account, use this admin rights to unlock the System Preferences and manually correct this.

So anyone know of a way to correct this date and time, without the end-user (without admin rights) bringing the Macbook to me ?

[PaulHazelden]

Can you SSH in to it and correct it from the session remotely?

[sdunbar]

This might help

https://github.com/talkingmoose/Jamf-Scripts/blob/master/Set%20Time%20Zone.sh

[Bernard_Huang]

Thanks @sdunbar

I'm reading the github script. Not having actually ran it, I believe this is setting the timezone to be automatic (that's what the description says)

Does it also do the auto time and date checkbox? From System Preference > Date & Time, these are actually different things.

[Bernard_Huang]

Thanks @sdunbar

You've given me the idea of seeking how to set Date and Time automatically.

terminal line is this:
sudo systemsetup -setusingnetworktime on

I have now included this in my Policy + script, testing it now.

[Bernard_Huang]

I think I got it

systemsetup -setnetworktimeserver $NTP_SERVER

systemsetup -setusingnetworktime on

I just found out ntpdate is no longer a function of macOS Mojave. That's why it is failing to update the time server for Macbooks that have time out of sync.

[Bernard_Huang]

Still doesn't work.

I can fix up my script, but without the Date and time being within 5 minutes of the JAMF Pro server, it will never communicate with the Macbook having the issue. User also do not have admin rights to fix this themselves :(

Here's the error I get when I manually trigger it off:

sudo jamf policy
sudo: ignoring time stamp from the future
Password:
Error getting version information from the JSS. Attempting to gather the information from a policy request...

There was an error.

     Clock Skew Error - There is a discrepancy between the local time and the JSS server time.

[zoeleech · Accepted solution]

At least in the version I'm running I can edit the Clock Skew Error and set it to No Maximum. Would this work, at least long enough to get the sort out the problem? I have no idea if it will deal with 2+ years difference

Nice picture of the option in Settings -> Computer Management -> Security of the option
https://www.jamf.com/jamf-nation/discussions/24544/maximum-clock-skew

[Bernard_Huang]

Thanks @zoeleech :)

Thank you for this. I think it is the closest I can get to to making JAMF Pro connect with Self Service Client, having this flag set to "no maximum"

I have tested this, no, the clock will not reset for a date/time that is more than 2 years old.

So the new process is:
- Set this JAMF Pro Max Time Skew change to no maximum
- Push out policy to grant admin rights to the user of the offending Macbook
- Have the user update the date & time themselves
- Remove admin rights

[curullij]

@Bernard.Huang

What if you put a policy in Self Service that called a script to update the time from your preferred time server?

sudo sntp -sS time.apple.com

That will work in Mojave, and it could be left in SS all the time; I can't see what harm a user could do by running the policy if there time was up to date.

[mickgrant]

try using PKGBUILD to wrap your time set script up in an executable pkg file and send it to them.
they just double click and boom your back in business baby.
all the instructions on how are in the link

[Stubakka]

I have this EXACT issue also with some older 2015 MacBook pros who's batteries were not replaced while under warranty and when they go to Zero they reset the time to like 2010 etc and cant communicate with the JAMF SERVER, I have tried some scripts but has anyone come up with something I can load offline in self service and offer as a fix for this issue?

[Chris_Hafner]

I just wanted to add that you can open up the time and date preference pane to all users, instead of just admins.

security authorizationdb write system.preferences allow
security authorizationdb write system.preferences.datetime allow
security authorizationdb write system.preferences.timemachine allow

I haven't tested on the latest version of Catalina.