MakeMeAnAdmin VS ProfileManifestsMirror

im trying to use the MakeMeAdmin for MacOSX ( GitHub - jamf/MakeMeAnAdmin: Provides temporary admin access for a standard user via Jamf Self Service )

I'm looking for some solution to grant user temp admin rights (for example 10 minutes). I tried to do this similarly as I do it with Jamf, take that script, pack it as a .pkg*, and allow users to install it to get 10 minutes of local admin. With Jamf it works like a charm, tests with manual installation are positive too (manual I mean run it as a root on my test MacBook). Unfortulently Intune deployment won't work. It stops at downloading status and nothing happens. To create an installation package I use Jamf Composer.

My school MacBook used to have a make me an admin command in Self Service, but for obvious reason it was removed. I have seen a few other kids use a script to route presumably https://github.com/jamf/MakeMeAnAdmin through self service allowing it to execute a sudo command. When I try to run the script on it’s own it asks for a Sudo password which I obviously don’t have. Does anybody know how I could write this script or know how to get this script to run? Thanks

Before the release of Monterey, I was experimenting with krypted's MakeMeAnAdmin script. After the release of Monterey, I started noticing issues with the script, especially when executed on Apple Silicon Macs. Then, I discovered geekquixotic's MakeMeAnAdmin Script. The script seems to work very well for elevation and removal of privileges, but I'm having some trouble getting the logging and the group removal feature working. I'm hoping someone else uses this variation of MakeMeAnAdmin and can help me figure out what I might be doing wrong.

For a real-world example, look at Jamf’s own “MakeMeAnAdmin” script (https://github.com/jamf/MakeMeAnAdmin/blob/master/MakeMeAnAdmin.sh). This is designed to do exactly what I describe above, but it doesn’t work for me on Monterey or on Big Sur. The LaunchDaemon is never actually removed from /Library/LaunchDaemons after it gets unloaded and the script is not deleted either.

You can make custom profiles in Jamf using the same json imazing uses/same repo. This will give you access to all of the keys available in the software. I think the reason they say it’s not enterprise software is there is no central control like chrome or edge. https://github.com/Jamf-Custom-Profile-Schemas/ProfileManifestsMirror

If you are using Jamf, this custom settings json should help with the vast majority of what you are wanting to do.

It might be easier to use a custom settings json. Here is one from a source that Jamf featured on their blog last year.

You should look into using Custom Settings json files to handle this. Here's one from a Jamf recommended source that I use in my environment. It works really well, and it's much easier to understand at a glance than a plist is.

If you're using Jamf Pro, you may be better off using a Custom Settings JSON to apply these settings.

Are you wanting to completely disable it or just skip it during initial sign in? This custom settings json should help with the latter, and if you then restrict access to the "Screen Time" preference pane that should be a roundabout way to fully disable it.

Rather than putting the energy towards this script, you should start working on how to deploy the official one. All of the config settings are available now. If you are using Jamf, you can even use this custom settings json to handle like 90% of the work. The only major thing to know in advance is that the settings "KFMOptInWithWizard" and "KFMSilentOptIn" are looking for your tenant ID.

If you're using Jamf, this custom settings json should help with managing most of those kinds of settings.

One and done setup, though a Custom Settings json file can really streamline any modifications you have to do down the line.

I believe WebAppInstallForceList is the setting you are looking for. It looks like that is included in this custom settings json though I have not verified that it will work.