Presentation Mode

Help your users have successful presentations with a Self Service policy which temporarily extends screensaver password timeouts, computer sleep options and automatic policy executions, then automatically restores approved security settings after a configurable duration

Genesis

Some time ago, one of our C-level leaders — who wisely prefers macOS — was presenting to a group of other C-level leaders (most of whom use a different operating system).

The PDF-only presentation was going well and a particular page sparked a discussion; a discussion which lasted more than 15 minutes.

We all know what happens when a MacBook Air running on battery power sits idle for more than 15 minutes (especially a MacBook Air which has a battery-saving Configuration Profile installed):

Put the display to sleep after: 15 minutes
Require password immediately after sleep or screen saver begins

As the discussion concluded and our C-level leader woke up his Mac to resume his PDF-only presentation, his Mac greeted with a login prompt, a login prompt which required multiple attempts to complete, all while projecting in front of the group of other C-level leaders.

Thus was Presentation Mode born.

Overview

Presentation Mode leverages the Jamf Pro API to switch between one of two Configuration Profiles:

Security & Privacy: Security-approved settings for screensaver password timeouts, computer sleep options, etc.
Presentation Mode: Security-approved relaxed settings for screensaver password timeouts, computer sleep options, etc.

Using lessons learned from Your Internal Beta Test Program: Opt-in / Opt-out via Self Service, a Presentation Mode 2 Pop-up Menu Extension Attribute includes two options:

Disabled
Enabled

Two Smart Groups — Presentation Mode 2: Enabled and Presentation Mode 2: Disabled — are used to scope the Configuration Profiles

Security & Privacy is scoped to Presentation Mode 2: Disabled
Presentation Mode is scoped to Presentation Mode 2: Enabled

A LaunchDaemon created just-in-time executes a Jamf Pro policy via a Custom Event after a configurable duration to disable Presentation Mode and restore standard security-approved settings.

Setup and Configuration

API Permissions for Computer Extension Attributes

Create a Jamf Pro Standard Account …

Username: apiPresentationMode2
Access Level: Full Access
Privilege Set: Custom

… with the following privileges:

Jamf Pro Server Objects	Read	Update
Computer Extension Attributes	√	√
Computers	√	√
User Extension Attributes	√	√
Users	√	√

Extension Attribute

Create the Presentation Mode 2 Extension Attribute with the following settings:

Data Type: String
Input Type: Pop-up Menu
- Pop-up Menu Choice: Disabled
- Pop-up Menu Choice: Enabled

Smart Groups

Create two Smart Groups using the following criteria:

Presentation Mode 2: Disabled

Presentation Mode 2 is Disabled
or Presentation Mode 2 is {blank}

Presentation Mode 2: Enabled

Presentation Mode 2 is Enabled

Configuration Profiles

Security & Privacy: Security-approved settings for screensaver password timeouts, computer sleep options, etc., scoped to Presentation Mode 2: Disabled.

Restrictions
Login Window
Security and Privacy
Energy Saver

Presentation Mode: Security-approved relaxed settings for screensaver password timeouts, computer sleep options, etc., scoped to Presentation Mode 2: Enabled. (Most frequently created from a clone of the Security & Privacy Configuration Profile.)

Restrictions
Login Window
Security and Privacy
Energy Saver

Scripts

Delayed Policy Trigger Create

Customize the plistDomain variable and add the following Parameter Labels to the Delayed Policy Trigger Create.bash script:

Parameter 4: Unique Daemon Label
Parameter 5: Jamf Pro policy trigger name
Parameter 6: Interval (in minutes)

Delayed Policy Trigger Disable

Customize the plistDomain variable and add the following Parameter Label to the Delayed Policy Trigger Disable.bash script:

Parameter 4: Unique Daemon Label

Display Message: JAMF binary

Add the following Parameter Label to the Display Message JAMF binary.bash script:

Parameter 4: Text of end-user message

Extension Attribute Update

Generate Encrypted Script Parameters for the encrypted API account password and update the following variables in the Extension Attribute Update.sh script:

apiURL
Salt
Passphrase

I add the following snippet to the bottom of EncryptedStrings_Bash.sh so the values will be output to Terminal when called via: ./EncryptedStrings_Bash.sh 'Purple Monkey Dishwasher'

# Output to Terminal
args=("$@")
password="${args[0]}"

GenerateEncryptedString "${password}"

Add the following Parameter Labels to the Extension Attribute Update.sh script:

Parameter 4: API Username (Read / Write)
Parameter 5: API Encrypted Password (Read / Write)
Parameter 6: EA Name (i.e., "Presentation Mode 2")
Parameter 7: EA Value (i.e., "Enabled" or "None")

Policies

Policies Overview

The following provides an overview of both policies: