Admin Threshold

The default threshold for when a reminder popup appears is 15 minutes. If you would like to set a different threshold, you may do so with a configuration profile.

In versions 2.1 and later, the threshold may be calculated based on the DockToggleTimeout key set in the SAP Privileges preference domain corp.sap.privileges

Additionally, in versions 3.0 and later, the threshold may be calculated based on the reminderThreshold key in the PrivilegesDemoter preference domain blog.mostlymac.privilegesdemoter

Using a PrivilgesDemoter Preference (Recommended)

This preference is native to PrivilegesDemoter and controls the time (in minutes) before a user sees the reminder popup.

Key: reminderThreshold
Type: Integer
Default Value: 15
Required: No
Domain: blog.mostlymac.privilegesdemoter

<key>reminderThreshold</key>
<integer>15</integer>

Using a SAP Privileges Preference (Optional)

This preference is meant to control the elapsed time before automatically demoting a user when using the "Toggle privileges" function of SAP Privileges. Optionally, you may also use this key to control PrivilegesDemoter's admin threshold. More information about this key is available in the SAP Privileges wiki here.

When using this key, if the user selects toggle privileges from the SAP Privileges menu, they will be demoted by the SAP Privileges application prior to seeing any notifications from PrivilegesDemoter. If they do not use the toggle privileges function, PrivilegesDemoter will provide a reminder notification.

You may find an example .mobileconfig in the Configuration Profiles folder here.

Precedence

Precedence goes to the reminderThreshold key in the PrivilegesDemoter preference domain blog.mostlymac.privilegesdemoter

Followed by the DockToggleTimeout key set in the SAP Privileges preference domain corp.sap.privileges

If both of these keys are left un-configured, a default value of 15 minutes will be applied.

If you attempt to set the timeout to 0, a default value of 15 minutes will be applied.

Admin Threshold Caveats

PrivilegesDemoter only runs once every 5 minutes. Due to this limitation, the following statements are true:

• The reminder notification may occur up to 5 minutes later than the admin threshold you set.
• Setting the threshold to any integer below 5 will result in a threshold of 5 minutes.
• Using the --admin-time option before PrivilegesDemoter has had time to run will not show an accurate amount of time. Instead, the timer will start at the moment this option is passed.