#!/bin/bash

###################################################################################################
# Script Name:  Remove-LocalAdminRights.sh
# By:  Zack Thompson / Created:  2/14/2020
# Version:  1.1.0 / Updated:  7/20/2020 / By:  ZT
#
# Description:  This script removes local accounts from the local admin group; accounts that are 
# 		desired to be in the group are be specified from the Jamf Pro script parameter 4
#
###################################################################################################

echo "*****  Remove-LocalAdminRights Process:  START  *****"

##################################################
# Define Variables

prod="https://prod.jps.server.com:8443/"
prod_jma="jma"
dev="https://dev.jps.server.com:8443/"
dev_jma="jmadev"

##################################################
# Build protected_admins array

protected_admins=()
protected_admins+=("root")

# If parameters were provided, loop through them.
if [[ -n $4 ]]; then
	IFS="," read -a accounts <<< "${4}"

	for account in "${accounts[@]}"; do
		protected_admins+=("${account## }")
	done
fi

# Check the local environment and remove the proper account
if [[ -e "/Library/Preferences/com.jamfsoftware.jamf.plist" ]]; then
	jss_url=$( /usr/bin/defaults read "/Library/Preferences/com.jamfsoftware.jamf" jss_url )

	if [[ "${jss_url}" == "${prod}" ]]; then
		protected_admins+=("${prod_jma}")
	elif [[ "${jss_url}" == "${dev}" ]]; then
		protected_admins+=("${dev_jma}")
	else
		echo "ERROR:  Unknown Jamf Pro environment!"
		exit 2
	fi
else
	echo "ERROR:  Issue with the Jamf Framework!"
	exit 1
fi

##################################################
# Bits staged...

exit_code=0

# Get a list of the current admin group
admin_users=$( /usr/bin/dscl . -read Groups/admin GroupMembership | \
	/usr/bin/awk -F "GroupMembership: " '{print $2}' )

# For verbosity in the policy log
echo "The following accounts are in the local admin group:"
for user in $admin_users; do
	echo " - ${user}"
done

# Loop through the admin users
for local_user in $admin_users; do

	echo -e "${local_user} - "

	# Check if the admin user is a protected_admin
	for protected_admin in "${protected_admins[@]}"; do

		if [ "${protected_admin}" == "${local_user}" ] ; then

			# Remove user from the admin group
			/usr/sbin/dseditgroup -o edit -d "${local_user}" -t user admin
			exit_code_check=$?

			# Check if the removal was successful
			if [ $exit_code_check == "0" ]; then
				echo "removed from admin group"
			else
				echo "FAILED to remove from admin group"
				exit_code=1
			fi

		else
			echo "protected admin"
		fi

	done

done

# Get an updated list of the local admin group
updated_local_admin_group=$( /usr/bin/dscl . -read Groups/admin GroupMembership | \
	 /usr/bin/awk -F "GroupMembership: " '{print $2}' )

# For verbosity in the policy log
echo "Updated local admin group:"
for user in $updated_local_admin_group; do
	echo " - ${user}"
done

echo "*****  Remove-LocalAdminRights Process:  COMPLETE  *****"
exit $exit_code