Privileges Helper Scripts

• create a Package containing checkPrivileges.sh (-> /usr/local/bin/) and the LaunchDaemon Files (-> /Library/LaunchDaemon/)
• add postinstall Script which registers them

launchctl load -w /Library/LaunchDaemons/de.lrz.privileges.demote.plist
launchctl load -w /Library/LaunchDaemons/de.lrz.privileges.check.plist

• create demotePrivileges.sh inside jamfPro
• create Policy inside jamfPro with custom trigger "privilegesDemote", set it to ongoing and make it available offline!
• create a TCC Payload with PPPCUtility allowing /usr/local/bin/jamf to send Events to Finder
• Install Package beside Privileges.pkg on the clients

Why so complicated?

• calling the script each time from jamfPro would spam the logs and ofc the server
• demoting locally without use of jamfPro would require you to sign the script AND there are no auditable logs
• a TCC payload is always required to display a Finder prompt (which is what you want, as users won't be able to ignore this one!)

Credits

Big thanks for TravellingTechGuy for the idea.