Nudge Extension Attribute

What is Nudge?

Nudge is an open source application (primarily created by Erik Gomez) that strongly encourages users to apply macOS updates.

Nudge has been written and talked about plenty of times by my fellow MacAdmins, so I’ll spare you the details. Here are some links if you want more info:

Getting Data from Nudge into Jamf Pro

Nudge stores information about the next time Nudge will run, the minimum required OS version you have defined, and how many deferrals have been used in the plist located at ~/Library/Preferences/com.github.macadmins.Nudge.plist

Notice this is in the user’s local Library. If we want to report this data, we will need to do it in the user context. I have developed the following Jamf Pro extension attribute to do just that.

The following EA will grab the currently logged in user (or the last user if there isn’t one) and read the requiredMinimumOSVersion key value from the com.github.macadmins.Nudge plist. If a value exists, we use the is-at-least function built in to zsh to compare this to the currently installed macOS version. If an update is required, we report the number of deferrals used. This can be useful to ensure that Nudge is running successfully, or to see which users are procrastinating (and how much).

  • If the requiredMinimumOSVersion key is not found, the EA will report No minimum required macOS version found
  • If the requiredMinimumOSVersion key is found, but macOS is already greater than or equal to that value, the EA will report macOS meets minimum required version
  • If macOS does not yet meet the minimum required version, the EA will report the value found in the userDeferrals key. This key is the sum of userSessionDeferrals and userQuitDeferrals.

And here is that extension attribute. Note that it is written in zsh so that we can access functions specific to that shell. It will not work with a .sh extension.

#!/bin/zsh
# Get the currently logged in user
currentUser="$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' )"
# Check for a logged in user and proceed with last user if needed
if [[ $currentUser == "" ]]; then
# Set currentUser variable to the last logged in user
currentUser=$( defaults read /Library/Preferences/com.apple.loginwindow lastUserName )
fi
# Get the current user's UID
currentUserID="$( id -u "$currentUser" )"
# Nudge plist name
nudgePlist="com.github.macadmins.Nudge.plist"
# Get the current OS version
osVersion="$( /usr/bin/sw_vers -productVersion )"
# Get the required minimum OS version from the plist
minOS="$( launchctl asuser "$currentUserID" sudo -u "$currentUser" defaults read $nudgePlist requiredMinimumOSVersion 2>/dev/null )"
# Report info from nudge plist
if [[ $minOS ]]; then
# Check if OS version meets the requirement using zsh is-at-least function
autoload is-at-least
if is-at-least "$minOS" "$osVersion"; then
result="macOS meets minimum required version"
# If not up-to-date, get the number of deferrals from the plist
else
result="$( launchctl asuser "$currentUserID" sudo -u "$currentUser" defaults read $nudgePlist userDeferrals )"
fi
else
result="No minimum required macOS version found"
fi
echo "<result>${result}</result>"

Smart Group

This extension attribute reports its result as a string. That means we cannot access the integer comparison tools within a Jamf Pro smart group, but we can use a regex.

I set up a smart group to find all devices where the Nudge deferral value is greater than 0 with the regex: ^[1-9][0-9]*$

2 thoughts on “Nudge Extension Attribute”

  1. Pretty cool work, thank you!
    FYI, your regex is looking for numeric values of 10 or greater, not 0 or greater. You would want just ^[1-9] for greater than 0 (and there’s no need to include anything after that in the regex string, because you’ve already got a match).
    However, one suggestion would be to only return numeric values, and then you could just use Jamf’s built-in number comparison, instead of messing around with regex. You could use a value of “-2” instead of “No minimum required macOS version found”, and “-1” instead of “macOS meets minimum required version”.

    Like

  2. Hello Mostly Mac. Thank you for creating this EA.
    There seems to be a typo on line 13 where it says uid. It’s not used anywhere else. I’m new at this, so it took me a while a some friends to help me suss it out.

    Like

Leave a Reply to WFH Sam Cancel reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s