Components

Below is a list of all the pieces that are needed to make this workflow a success.

grantTempAdmin.py

workingDir

This is the location where all the workflow assets are stored. In this directory we will create a plist and log file to record what is being done

launchdFile

This is the launch daemon that will be created to trigger the removal of admin privileges based on the adminTimer specified.

plistFile

This is the plist file that will be created when a user requests temporary admin privileges. This plist file will track the user requesting temporary admin rights along with what current admin accounts are on the system.

tempAdminLog

This is the name of the log file that will be created within the workingDir.

adminTimer

Here you can specify how long the user will be granted temporary admin privileges. This numerical value is in seconds (i.e., 10 minutes = 600 and 30 minutes = 1800).

policyCustomTrigger

This is the name of the custom trigger specified when creating the removeTempAdmin policy in Jamf Pro.

removeTempAdmin.py

workingDir

This is the location where all the workflow assets are stored. In this directory we will create a plist and log file to record what is being done

launchdFile

This is the launch daemon that will be created to trigger the removal of admin privileges based on the adminTimer specified.

plistFile

This is the plist file that will be created when a user requests temporary admin privileges. This plist file will track the user requesting temporary admin rights along with what current admin accounts are on the system.

statusFile

This is the name of a plist file that will be created within the workingDir which can be used in conjunction with the Extension Attribute to report if the user violated their tempAdmin privileges by modifying an existing organizational admin account and/or creating a new local admin.

tempAdminLog

This is the name of the log file that will be created within the workingDir.

orgAdmins

Here you can specify the organizational admin account that you would like to ensure a user given temporary admin rights does not modify. If you'd like to specify multiple organizational admin accounts, please head over to Multiple Org Admins to see how to accomplish this.

salt

Please refer to Encrypted Strings.

passphrase

Please refer to Encrypted Strings.