FAQ's

Will this remove admin rights from any other accounts on my clients?

No, when the user requests temporary admin rights a plist is generated on the local system storing any existing admin accounts that were already there. When the admin rights are revoked for the user, that plist is checked and the accounts listed are skipped.

What happens if the user creates a local admin account?

When the users admin rights are revoked we also check if any other admin accounts have been created since the permissions were requested. If any new admin accounts are found, the admin permissions will be revoked for those accounts as well.

What happens if the user changes our organizational admin account?

As part of the workflow, when the users admin rights are revoked we will check any specified orgAdmin accounts to ensure the "known" password hasn't changed. If it has, we'll reset the password on the account to the "known" password provided in the script.

What does the extension attribute report on?

Compliant - This occurs when everything works correctly and the user didn't attempt to create another admin account and/or change the orgAdmin credentials.

Remediated - This will happen if the user creates a new admin account or they change the password on the orgAdmin account, but we were able to successfully remove the admin rights from the newly created admin account and reset the password back to what is expected for the orgAdmin.

Violation - This will only happen if the user changes the orgAdmin password and for some reason we are unable to reset it.

Either way...Remediated and Violation are both bad users. This flag will "reset" back to Compliant whenever they run the policy and complete the workflow successfully without any malice intent.