--credentials and very insecure mode

[kbreed27]

The management at my place of work is keen to implement using silent updates on our Macs. MDM commands are so unreliable. If we use the insecure mode of the erase/install script and pass the base 64 encoded credentials through Jamf "files and processes" payload, is there anywhere on the local machine those creds are stored in a log?

Or is it just accessible inside JAMF?

[grahampugh]

Not that I am aware of, but I am not taking responsibility for your decision :-) So I advise you to test thoroughly. I do not recommend the use of the insecure mode for single-user computers, that's why I enforced the flag "--very-insecure-mode" to make you think twice and test thoroughly.

[Trikster-Online]

Do you have an example of how this script should look? I have 300 lab computers that are a pain in the butt to update and this "mode" would work so nicely. I have used a script similar to sniper8952 below with no joy.

[grahampugh]

It's in the wiki: https://github.com/grahampugh/erase-install/wiki/5.-Erasing-macOS#--very-insecure-mode----credentials

[sniper8952]

@grahampugh Could you please make an example with --very-insecure-mode in the instructions?

I tried it this way with Jamf Pro but it didn't work:
/Library/Management/erase-install/erase-install.sh --version 14.4.1 --erase printf "%s:%s" "admin-rental" "Password" | iconv -t ISO-8859-1 | base64 -i - --credentials ENCODEDCREDENTIALS --very-insecure-mode --no-fs --check-power --confirm -test-run

Thank you

[Trikster-Online]

I will try this again, but the last time I attempted doing this...I used exactly what is shown, except for the version number. Do I have to be signed into the admin account that I am using to create the encoded credentials?

[grahampugh]

No you don't need to be signed in as that account, but it does need to be a Volume Owner. (it doesn't need to be an admin account either). The version part is irrelevant.

[grahampugh]

Note that @sniper8952 's command is completely wrong, so don't copy that.

[Trikster-Online]

I will try again. I followed the guide in the wiki and got credentials and everything. When I went to test, it failed every time.

[grahampugh]

Feel free to post the output, in case that would help with the diagnosis. There are many reasons the script can fail.