Unable to make a std user as an admin

[sk25]

Guys,

We are migrating to Intune from Jamf. And our end users are standard users and for the installation of MDM profile it's prompting for administrator credentials. So I tried making the standard users as an admin using shell script and as soon as they enrolled into Intune once again using another shell script to convert them to standard users. But that's not working when I tried it in my Mac as username should be add in sudoers file. Even unable to create an admin account too getting the below message. Kindly advice.

[PiyushVerma]

So if understood, you need 2 scripts: 

One which can elevate the access from standard to Admin and other to remove admin access after enrolling the devices, correct?

[sk25]

Correct Piyush Verma

[mm2270]

You might want to post the contents of your promote.sh script so we can see what you're doing in it. I have a feeling the way you're trying to make the user an admin is wrong. You don't want to be touching the sudoers file.

[sk25]

#!/bin/sh

##########################################################################################
# License information
##########################################################################################
#
# Copyright (c) 2021, JAMF Software, LLC. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
# * Neither the name of the JAMF Software, LLC nor the
# names of its contributors may be used to endorse or promote products
# derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
##########################################################################################
#
# Version: 1.0
# Written by: Armin Briegel | Consulting Engineer | Jamf
#
# DESCRIPTION
# This script will add the currently logged in user (if any) from the admin group,
# thus providing access to administrator privileges.
#
# This script provides no mechanism to automatically demote the user again.
# If the demoteUser.sh script is running from a recurring policy, admin privileges will
# be removed the next time the demoteUser.sh script runs.
#
# DEPLOYMENT
# Deploy this as a Self Service policy script in Jamf Pro.
#
##########################################################################################
##########################################################################################

export PATH=/usr/bin:/bin:/usr/sbin:/sbin

currentUser=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/Name :/ { print $3 }' )

# if no current user, exit quietly
if [ "$currentUser" == "loginwindow" ]; then
# no user logged in
echo "no user logged in, exiting"
exit 0
fi

# is the current user in the admin group?
if dseditgroup -o checkmember -m "$currentUser" admin; then
echo "$currentUser is already in the admin group"
else
# remove the user from the admin groups
echo "adding $currentUser to admin group"
dseditgroup -o edit -a "$currentUser" -t user admin
fi

[mm2270]

Ok, so nothing looks off in your script there. It's a script from Armin Briegel, so it should be A-OK. It's using the approved method of making a user an admin, dseditgroup

My other question is, is the localuser account an admin already? In your screenshot you're trying to run this script from that account, but it requires that user to be an admin account already to do anything with sudo. I assume you know that, but just wanted to check that it wasn't something simple like that.

[sk25]

Yes, you are right.