This document outlines how to set up the TechIDAgent.macOS, which runs on a standalone macOS workstation, to create and manage identities for technicians.
This is pre-release documentation and subject to change. Most command lines from TechIDAgent.Windows work the same in TechIDAgent.macOS.
Definitions:
Target Machine – macOS machine, where identities will be managed
Client ID – Guid assigned by RuffianSoftware in the form XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX where X is an alphanumeric character.
If you don’t have one, Request a Client ID. Use the same Client ID for all TechIDAgent, TechIDAgent.EntraID, or TechIDClient installations.
TechIDAgent.zip – Downloadable archive from Ruffian Software containing all required executables.
Install Folder – Directory on the Target Machine where the TechIDAgent.mac will be extracted.
Steps:
At this point the domain will be assigned to the “All Domains” domain group in the TechIDPortal and any techs and rights assigned with “All Domains” in a DomainTechRights group will be created.
In general, TechIDAgent.Mac is run to set options that are used by the daemon later when it runs. Options can be set on separate lines to ease scripting and installing.
The options listed on this page are for the most recent version of techidagent.mac. Some older versions don’t support all these options. All options are of the format ABC or XYZ value where ABC is an option to set with no additional parameters and XYZ requires an additional commandline parameter value. See “start” and “clientguid” above.
- help – Show this helpful output
- show – show all options that are set.
- JustInTime – (version 4.0 and newer) make all accounts controlled by this instance be Just-In-Time accounts
- Managed – (version 4.050 and newer) make all the accounts controlled by this instance be managed accounts (this is the default)
- clientguid value – Specify the ClientGuid to use when accessing the TechIDPortal
- domainguid value – Specify the DomainGuid to use when accessing the TechIDPortal (This is unique to each domain, and should ONLY be set when migrating a domain controller)
- leaf value – (version 5.0 and newer) Specify the leaf that accounts for this Agent will be on. The Leaf must already exist in the TechIDPortal, and the name must be an exact match, otherwise the request is ignored. The use of quotes (“…”) is recommended. https://ruffiansoftware.com/trees-and-leaves-or-leafs/
- agentgroup value – (version 5.0 and newer) Specify the AgentGroup name that this Agent should join by default. The AgentGroup must already exist in the TechIDPortal, and the name must be an exact match, otherwise the request is ignored. The use of quotes (“…”) is recommended.
- friendlyname value – Specify a searchable string for use in the TechIDClient that is specific to this domain or machine
- rmmname value – Specify a searchable string for use in the TechIDClient that is specific to this domain or machine (This is NOT the name of the RMM used on this machine)
- force – Run once in this context and exit (for testing only – do not use without explicit direction to do so from Ruffian Software)
- displayname value – Specify the format used to set the Display Name in AD for managed tech accounts (use “reset” to return to default value) https://ruffiansoftware.com/username-displayname-accountdescription-feature-in-techidagent-piece-of-techidmanager/
- username value – Specify the format used to make the UserName for managed tech accounts (use “reset” to return to default value) https://ruffiansoftware.com/username-displayname-accountdescription-feature-in-techidagent-piece-of-techidmanager/
- accountdescription value – Specify the format used to set the Account Description in AD for managed tech accounts (use “reset” to return to default value) https://ruffiansoftware.com/username-displayname-accountdescription-feature-in-techidagent-piece-of-techidmanager/
- loglevel value – Specify the loglevel used to 0 (less) to 10 (more)
- hideonloginscreen – prevent techs’ local accounts from showing on the login screen.
- showonloginscreen – show techs’ local accounts on the login screen
- HourToRun value – 24 hour based hour in which runtime changes passwords (default is 0). This can be a comma separated list of hours to run in (i.e. “0,9,18” will at midnight, 9 am, and 6 pm).
- RunAfterMiss – If the HourToRun window is missed, then run as soon as the machine is capable.
- RunInWindow – Only run during the HourToRun window. Don’t run at other times (this is the default).
- forceshortnames – force the use of user names with length no more than 20 character
- allowlongnames – allow the use of user names with any length (this is the default behavior)
- PasswordLength value – override TechIDPortal password length setting for just this domain (range is 8-128) (use “reset” to return to using TechIDPortal value)
- UseWordListPassword – (version 5.438 and newer) override the TechIDPortal option and use words to build a password instead of fully random passwords
- UseRandomPassword – (version 5.438 and newer) override the TechIDPortal option and use only random characters to build a password instead of the word list.
- UseDefaultPassword – (version 5.438 and newer) use the TechIDPortal options for building passwords
- PasswordWordCount value – (version 5.438 and newer) override the TechIDPortal option on minimum number of words to use to build a word list password (range is 2-20) (use “reset” to return to using management console value)
- GuaranteedRight value – (version 5.438 and newer) set a right that is always granted to tech’s accounts on this agent. Even when an account is disabled (and all other rights are removed) this right will be assigned. Think about the “Protected Users” AD Group. This can be a single right or a comma separated list of rights.
- version – print out the version of this TechIDAgent.
- host value – specify the address of the TechIDHost if using self-hosted TechIDManager (normally left blank)
- SetTechSecondFactor tech value – (version 6.074 and newer) set the second factor secret for a tech to the given value. This is to allow integration with Duo or any other MFA provider that you want that support TOTP MFA.
- InstallLAPS – Install TechIDAgent and tell it to only run a shared user setup, and do not run the default unique user setup of TechIDAgent.
- SharedUser name – Create a shared user setup for TechIDAgent and control the password for the name user. This will show up as an agent with the MachineName\name in the TechIDPortal. All options after this on the command line apply only to this named instance.
- Instance name – Create a unique user setup of the TechIDAgent. This can be used to control the username formatting for a subset of techs in a co-managed setup. This will show up as an agent with the MachineName\name in the TechIDPortal. All options after this on the command line apply only to this named instance.
- RemoveInstance name – Remove the unique user setup with the given name.
- RemoveSharedUser name – Remove the shared user setup with the given name.
- DoNotRun – Cause the current setup (as specified earlier on the commandline) to not run. This leaves all the data intact for the instance and it can be set to run later with “DoRun”.
- DoRun – Cause the current setup (as specified earlier on the commandline) to be run. This is the default for all setups that are created.
Here is some documentation on the setups/instances and how to use them. https://ruffiansoftware.com/instances-in-techidagent/
Here is some documentation on converting a PAM setup/instance to a shared/LAPS setup/instance. https://ruffiansoftware.com/convert-pam-to-laps/
