MAC-005 · Script
Local Admin Access Control
Reports which local accounts are administrators, and can add or remove admin rights, remove anyone not on an allowed list, or grant temporary admin rights that are removed automatically. It never removes the last remaining administrator.
Version 1.0.0Language bashUpdated November 2026
What it does
Temporary admin uses a LaunchDaemon (com.runbookia.tempadmin) that checks every 5 minutes and removes itself when no grants remain.
Requirements
macOS 12 or later, run as root (MDM or RMM default). No prompts.
How to run it
- Run as: root (sudo in Terminal, or your MDM default)
- Run from: any MDM or RMM, a LaunchDaemon, or Terminal with sudo
- Script type: shell script (bash)
- User interaction: none; the script never prompts
- Timeout: 10 minutes (longer for app or update installs)
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| mode | default report | report, add, remove, temp, enforce | report |
| user | add, remove, temp | ||
| minutes | temp; default 30, maximum 1440 | 30 | |
| allowed | accounts that keep admin rights; used by report to flag others, and by enforce to remove others |
Exit codes
- 0 = Completed, nothing flagged
- 1 = Admins outside --allowed found (report mode)
- 2 = Script error
Testing steps
- Run it first with the mode set to report on one test device. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Report mode changes nothing. Restore rights with --mode=add --user=NAME. Temporary grants end on their own.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |