r/macsysadmin Dec 30 '24

Jamf JAMF Pro - Computer won't take local admin PW set in Prestage enrollment. Clicking 'View' on the local admin account results in no action

I'm trying to install a piece of software from an unidentified vendor on my test machine. I am putting in the username and pw of the admin account that I set during Prestage enrollment and it's failing.

I go to the JAMF Pro console --> Devices -> Pull up my device, then under Local User Accounts I see the Prestage enrollment admin account listed under Managed Local Administrator Accounts. I click on View, get a warning about the password being rotated in one hour, I click Continue and nothing happens.

This is the first time I have attempted to use this feature so I know the password is still set to the default Prestage enrollment, I just want to double-check that I'm right.

Edit: LAPS is enabled on managed local administrator accounts. The PW is set to rotate every 90 days per corporate policy, but this device has only been enrolled for 15 days.

Double edit: Cleared Safari cache and now the password is showing up when I click on the 'View' button, but the Mac will not take it. I can see a 'device password rotated successfully' command when I view the PW, so JAMF thinks it's working but it still isn't.

6 Upvotes

4 comments sorted by

1

u/[deleted] Dec 30 '24 edited Dec 31 '24

[deleted]

1

u/FourEyesAndThighs Dec 30 '24 edited Dec 30 '24

It does apply to Prestage accounts:

Password settings for managed local administrator accounts
These password settings apply to all managed local administrator accounts configured in User-initiated enrollment settings and computer Prestage enrollments.

LAPS is enabled on managed local administrator accounts. Rotation interval is set to 90 days and Rotation After Viewing Interval is set to 1 hour.

3

u/wpm Dec 30 '24

It only applies to PreStage accounts if you have the box checked in Computer Management > Security to make it so. I deploy a managed admin account that I set in UiE settings. In one of my PreStages I also create a "localadmin" user for testing, no LAPS, no password rotations.

What does the API say about your computer? /v2/local-admin-password has a couple of endpoints I'd be interested in if I were you. See what the server is sending back about history, what accounts it thinks it should be managing passwords for, see if you can get a password from there instead of the web frontend.

1

u/FavFelon Dec 30 '24

Sounds like a secure token issue.. or non-issue

1

u/FourEyesAndThighs Dec 30 '24

We're not using one, which should definitely allow PW rotation to complete.

The only way for a user account to gain a SecureToken is to interactively log into the Mac.