MakeMeAnAdmin VS erase-install

im trying to use the MakeMeAdmin for MacOSX ( GitHub - jamf/MakeMeAnAdmin: Provides temporary admin access for a standard user via Jamf Self Service )

I'm looking for some solution to grant user temp admin rights (for example 10 minutes). I tried to do this similarly as I do it with Jamf, take that script, pack it as a .pkg*, and allow users to install it to get 10 minutes of local admin. With Jamf it works like a charm, tests with manual installation are positive too (manual I mean run it as a root on my test MacBook). Unfortulently Intune deployment won't work. It stops at downloading status and nothing happens. To create an installation package I use Jamf Composer.

My school MacBook used to have a make me an admin command in Self Service, but for obvious reason it was removed. I have seen a few other kids use a script to route presumably https://github.com/jamf/MakeMeAnAdmin through self service allowing it to execute a sudo command. When I try to run the script on it’s own it asks for a Sudo password which I obviously don’t have. Does anybody know how I could write this script or know how to get this script to run? Thanks

Before the release of Monterey, I was experimenting with krypted's MakeMeAnAdmin script. After the release of Monterey, I started noticing issues with the script, especially when executed on Apple Silicon Macs. Then, I discovered geekquixotic's MakeMeAnAdmin Script. The script seems to work very well for elevation and removal of privileges, but I'm having some trouble getting the logging and the group removal feature working. I'm hoping someone else uses this variation of MakeMeAnAdmin and can help me figure out what I might be doing wrong.

For a real-world example, look at Jamf’s own “MakeMeAnAdmin” script (https://github.com/jamf/MakeMeAnAdmin/blob/master/MakeMeAnAdmin.sh). This is designed to do exactly what I describe above, but it doesn’t work for me on Monterey or on Big Sur. The LaunchDaemon is never actually removed from /Library/LaunchDaemons after it gets unloaded and the script is not deleted either.

You can see the function being called here (lines 549-562):

- Using the MDM + Erase install (https://github.com/grahampugh/erase-install/), I'd send: curl -s https://raw.githubusercontent.com/grahampugh/erase-install/main/erase-install.sh | sudo bash /dev/stdin --erase -fs --check-power

Off the top of my head - if you are just wiping them you can use https://github.com/grahampugh/erase-install/wiki to do a full erase and re-install of macOS as part of a jamf policy. You could then add in a script as part of that policy that would contact the other system you want the outgoing webhook to point at.

Not with those arguments. You can read about it in their wiki https://github.com/grahampugh/erase-install/wiki

So, depending on the os version you can curl the script or better yet the pkg from this project and then execute the erase and add new container install. This will format the current container and install the os to a mew one and reboot as new. You should be able to suppress the dialogs and maybe even password prompts depending on the os version and model. If the machine is on pre MacOS11 you can use the legacy version.

I'm trying to test a few ways out. I tried eraseinstall (Erase-Install which I quite liked.

An option for automating updates is the erase-install tool and you don't have to erase you can just install.

Best way to jump straight to current would be allowing users to run erase-install (i,e. put it in Self Service if you have Jamf). It's a script on GitHub that has really streamlined the major update process. Just make sure you use the latest v27 (27.3 currently - https://github.com/grahampugh/erase-install/releases/tag/v27.3) as v28 and above don't work on Catalina or lower. It needs ~45GB of free space, so you're in for some real fun if you have a fleet of 128GB's you're trying to get updated. And I can't recall if v27 supports Mojave, may want to look through the documentation. All of your Mojave's and older will be Intel, which gives you more control over pushing updates (can do some command line stuff that doesn't work on M1).