Skip to content

Install and Configure

Jump to bottom
Sam Mills edited this page May 15, 2023 · 5 revisions

Note: The PrivilegesDemoter script has only been tested on macOS 10.15 Catalina and newer.

Selecting an Install Package

PrivilegesDemoter can be used standalone, or in combination with SAP Privileges, IBM Notifier, Swift Dialog, or Jamf Helper. There are specific packages available for each deployment scenario that include all application dependancies. This allows for easy deployment, but might not be right for every organization.

Use this matrix to select the package that is most appropriate for your environment:

IBM Notifier Swift Dialog Jamf Helper OR Silent
Standalone PrivilegesDemoter_IBMNotifier.pkg PrivilegesDemoter_SwiftDialog.pkg PrivilegesDemoter.pkg
SAP Privileges PrivilegesDemoter_SAPPrivileges_IBMNotifier.pkg PrivilegesDemoter_SAPPrivileges_SwiftDialog.pkg PrivilegesDemoter_SAPPrivileges.pkg

  • If you are already managing the deployment of SAP Privileges and one of the available notification agents, you should deploy the plain PrivilegesDemoter package and continue managing application dependancies separately.

  • If you are already managing the deployment of SAP Privileges, but not any of the available notification agents, you should deploy the standalone package that matches your intended notification agent.

  • If you are already managing the deployment of a notification agent, but not SAP Privileges, you should deploy the PrivilgesDemoter package that includes SAP Privileges.

  • If you are currently managing the deployment of neither SAP Privileges, nor a notification agent, you should deploy the PrivilegesDemoter package that includes both SAP Privileges and your preferred notification agent.

Background Service Management

In macOS 13 Ventura and later users are able to toggle background services (LaunchDaemons) on and off in the System Settings GUI. It is recommended to disable this ability so that the user cannot turn off the demotion reminders.

A Background Service Management profile may be used to disable GUI management of the PrivilegesDemoter LaunchDaemon.

Preference domain: com.apple.servicemanagement
Key: RuleType
Value: LabelPrefix
Key: RuleValue
Value: blog.mostlymac
Available for: macOS 13 and later

An example configuration profile is available in the Configuration Profiles folder here

Configuration

  • See the Preferences page for configuration information.

  • See the Admin Threshold page for more information about how the reminder threshold is calculated.

  • See the Demote on Login page for information about how to demote users each time they log in.

  • See the Jamf Pro Guide page for information about how to deploy and configure PrivilegesDemoter with Jamf Pro.

  • See the Standalone Mode page for information about using PrivilegesDemoter without SAP Privileges.

Clone this wiki locally