Skip to content

Instantly share code, notes, and snippets.

@smaddock

smaddock/mdm-reenroll.sh

Last active May 14, 2020
Embed
What would you like to do?
#!/bin/bash
### IMPORTANT NOTICE ###
### BEFORE USING THE SCRIPT MAKE SURE THAT YOU HAVE YOUR OWN APPLE PUSH CERTIFICATE AND MDM PROFILE SET UP IN YOUR ADDIGY ENVIRONMENT ###
# Best practice is to use this Script for devices that are in a Policy with the MDM Profile configured correctly
# This script is made with the intention of streamlining the migration from an expired APN/Apple Push Certificate to a new one
MDMProfileIdentifier="com.github.addigy.mdm.mdm"
majorVersion=$(sw_vers -productVersion | awk -F. '{print $2}')
minorVersion=$(sw_vers -productVersion | awk -F. '{print $3}')
# Gets realm, policyID, and orgID and makes them into variables
realm=$(cat /Library/Addigy/config/.adg_agent_config | grep -i "realm" | sed '/realm /s///')
orgID=$(cat /Library/Addigy/config/.adg_agent_config | grep -i "orgid" | sed '/orgid /s///')
policyID=$(cat /Library/Addigy/config/.adg_agent_config | grep -i "policy_id" | sed '/policy_id /s///')
# Modify these strings to change the verbiage in the badge notification.
title="MDM Profile Installed!"
acceptText="Open"
# Download Addigy MDM Profile
rm -f "/Library/Addigy/mdm-profile-$orgID.mobileconfig"
if [[ $policyID != "" ]]; then
echo "Downloading MDM with Policy"
MDMInstallLink="https://mdm-$realm.addigy.com/mdm/enroll/$orgID/$policyID"
else
echo "Downloading MDM without Policy"
MDMInstallLink="https://mdm-$realm.addigy.com/mdm/enroll/$orgID"
fi
/Library/Addigy/go-agent download "$MDMInstallLink" "/Library/Addigy/mdm-profile-$orgID.mobileconfig"
# Check whether downloaded Addigy MDM Profile matches installed MDM profile, if one exists
echo "Checking for installed MDM profile..."
if sudo profiles -P | grep $MDMProfileIdentifier >& /dev/null; then
echo "An MDM profile is already installed."
if (( majorVersion < 15 )); then
appPort="com.apple.mdmclient.daemon.push.production"
else
appPort="com.apple.aps.mdmclient.daemon.push.production"
fi
installedAPNTopic=$(/System/Library/PrivateFrameworks/ApplePushService.framework/apsctl status | grep -A 25 $appPort | grep topic: | tr -s ' ' | cut -d ' ' -f 3 | head -n 1)
downloadedAPNTopic=$(security cms -D -i "/Library/Addigy/mdm-profile-$orgID.mobileconfig" | xmllint --pretty 1 - | grep -A1 "Topic" | grep "string" | cut -d '>' -f2 | cut -d '<' -f1)
if [[ $installedAPNTopic == $downloadedAPNTopic ]]; then
echo "Installed profile matches what is configured in Addigy. No action taken."
exit 0
else
echo "Installed profile does not match Addigy. Removing old MDM profile..."
profiles -R -p $MDMProfileIdentifier
fi
else
echo "No MDM profiles currently installed."
fi
# Install Addigy MDM Profile
echo "Installing Addigy MDM Profile..."
profiles -IF "/Library/Addigy/mdm-profile-$orgID.mobileconfig"
# Request user approval of Addigy MDM Profile if needed
echo "Checking macOS version compatibility."
if (( majorVersion < 13 || (majorVersion == 13 && minorVersion < 4) )); then
echo "This device is on 10.${majorVersion}.${minorVersion}. Installing the Addigy MDM Profile, user approval is not needed."
else
echo "This device is on 10.${majorVersion}.${minorVersion}, installing the Addigy MDM Profile. Please approve the profile after install."
MDMProfileName=$(system_profiler SPConfigurationProfileDataType | grep -B 5 $MDMProfileIdentifier | sed 's/^ Description: .*$//g' | sed 's/^ Organization: .*$//g' | sed 's/^ Description: .*$//g' | sed 's/^ Organization: .*$//g' | sed 's/^ Installation Date: .*$//g' | sed 's/^ Identifier: .*$//g' | sed 's/://g' | sed 's/ //g')
description="Please approve profile: \"$MDMProfileName\" to gain full MDM functionality!"
if /Library/Addigy/macmanage/MacManage.app/Contents/MacOS/MacManage action=notify title="${title}" description="${description}" closeLabel="${acceptText}"; then
# This first condition body needs to stay empty because of the single user prompt
echo ""
else
open "/Applications/System Preferences.app" >& /dev/null
sleep 0.5
open /System/Library/PreferencePanes/Profiles.prefPane >& /dev/null
fi
fi
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment