pbowden-msft / nukeoffkeychain Goto Github PK

Hi Paul

This tool is great.

However, I'm having an issue when trying to run this remotely.

We use Addigy(which runs scripts 'Predefined commands' as root)

I'm delivering your NukeOffKeychain script to the client Mac, the downloaded copy from this repo.

The method I'm using is download the zip using curl(because I don't want to use git on client Macs to clone repo/download as it requires additional download from Mac Appstore)

I then extract the zip to our company folder location on the client Mac /Library

Then running the NukeOffKeychain as the current logged in user.

variable in my script is;
CURRENTUSER=$(/bin/ls -la /dev/console | /usr/bin/cut -d " " -f 4)

Calling it looks like;
su -l "$CURRENTUSER" /Library/Company/Office365/NukeOffice2016Keychain/NukeOffKeychain --All --Force
(I've used the variable above to run other scripts as the current logged in user before, but perhaps this is the issue?)

Permissions of the containing folder and script have been changed using the method below.
chmod -R 755 /Library/Company/Office365
chmod +x /Library/Company/Office365/NukeOffice2016Keychain/NukeOffKeychain

--
What Happens:
Outlook closes, but all the keychain items remain. Reopen Outlook and user is still logged in.

Running the 'curl'd script from the Mac works perfectly if I run it with ARD using 'send unix' with Current console user on target computer..

Which makes me think the variable "$CURRENTUSER" doesn't work in this scenario.

Any tips or things to try would be greatly appreciated.

Thanks again for all the work put in on the MacAdmins software.

As has been mentioned in the MacAdmins microsoft-office slack channel, there are issues with running this script via Jamf. Jamf automatically passes the first three arguments, causing the ShowUsage function to be called and then exiting the script without doing any work.

Fixing this would involve detecting whether the script is running under Jamf, and if so skipping the first three arguments. The second part is easy with the shift command. I believe there was mention of detecting the working directory or something like that but I think a simpler solution would be to just add a valid argument to signal that it needs to skip the first 3. Working on a Pull Request.

I am currently experiencing the infinite login loop issue for Office on MacOS issue and have no luck with this script and the --All command. Is the script maybe missing some other items which were introduced with current Office versions in the past 4 years?

Thanks in advance!

I am trying to use the --All option and getting an error in line 360 when it tries to call FindEntryAdalCache. There is a RemoveEntryAdalCache function defined, but not a Find function.

Wondering if the keychain entry "Exchange" might be added to the tool? I delete they entry, relaunch Outlook, am prompted for password, and when I click to save in keychain, the entry is recreated.

It'd be one less thing for me to script.

Thanks!

Hi Paul, I tried your NukeOffKeychain script and the proposal at https://apple.stackexchange.com/questions/395879/how-do-i-log-out-or-reset-microsofts-rms-aip-azure-information-protection (which is a shortened version of your script) to completely remove/reset any Right Management Service (RMS) / Azur Information Protection (AIP) settings. It does not work for me. The problem is that something on RMS/AIP was installed when I worked for a customer of my employer a long time ago. Now my employer is also using RMS/AIP to protect documents, but I get that old customer RMS/AIP login when I try to open a document protected by my employer, I cannot switch to my employee's RMS/AIP login. Do you have any ideas how to solve that? We're using O365 on Mac.

Just asking if Teams and OneDrive will also supported in a future release?