Mac Client - Install / Uninstall

Prerequisites

Admin By Request supports the following macOS versions:

  • macOS 10.15 (Catalina)

  • macOS 11 (Big Sur)

  • macOS 12 (Monterey)

  • macOS 13 (Ventura)

  • macOS 14 (Sonoma)

Installation may work on macOS 10.12 (Sierra) through 10.14 (Mojave), but product development and testing is not done on these versions and they are not officially supported.

Note that certain Mac 5.0 features, such as Admin Auditing and the new app installation flow, require macOS 11 or higher.

Your Tenant License

The installer file downloaded from the portal is unique to your tenant. Depending on the target operating system, it can be an executable file, a package or a script and it is signed with a license that applies only  to installers downloaded from the tenant in which you are currently logged-in. The same license file is applied to each of the operating system client installers: Windows, macOS, Linux and Server.

This is true for free plans as well as paid plans.

When installed on an endpoint, once the endpoint connects successfully, you will see in real time the status of the endpoint in your Inventory, which is also unique to your tenant. You will not see other endpoints installed with files downloaded from other tenants - this is simply not possible.

Admin By Request System Extension

Admin By Request 5.0 and higher includes an optional system extension to add additional functionality to the client – including intuitive installation of applications and additional admin entries for the auditlog.

To utilize this functionality, the system extension must be enabled and granted the correct permission.

KEY POINT:

If using other system extensions or real time scanning solutions like Microsoft Defender, CrowdStrike etc., please be aware that these can potentially conflict with each other.

Refer to Troubleshoot performance issues for Microsoft Defender for Endpoint on macOS for further details.

Full Disk Access (FDA)

Full Disk Access (FDA) must be enabled for both the adminbyrequest  application and the Admin By Request System Extension.

IMPORTANT:

The order of installation tasks matters and it differs depending on manual installation of a single endpoint, or automated installation of multiple endpoints via an MDM such as Jamf or Intune.

Installing Admin By Request

There are two procedures described - the first covering manual installation of one endpoint at a time and the second for the automated installation of multiple endpoints.

Single endpoint installation (manual)

This procedure describes how to manually install the Mac client on a single endpoint.

NOTE:

The following needs to be enabled on devices running ABR Mac 5.0 or later:

  • With System Extension:

    • Allow the Admin By Request System Extension
      (during installation - Download and install step 5)

    • Enable Full Disk Access to “adminbyrequest”
      (after installation - Enable FDA for two apps)

    • Enable Full Disk Access to the “Admin By Request System Extension”
      (after installation - Enable FDA for two apps)

  • Without System Extension:

    • Enable Full Disk Access to “adminbyrequest”
      (after installation - Enable FDA for two apps)

  1. Sign-in to your Admin By Request account at https://www.adminbyrequest.com/Login.

  2. Download the Mac client from the Download  page and store the client file in a suitable temporary location.

  3. Double-click the downloaded package to begin the installation.

    The package runs a check to determine if Admin By Request can be installed:

  4. Continue with the installation, providing Administrator credentials if necessary:

  5. If using system extension and prompted with System Extension Blocked, click Open System Settings and allow system software from Admin By Request:

  6. When done, close the installer and (optionally) move the installer package to the bin:

Installation is now complete. The next step is to ensure that Full Disk Access (FDA) is enabled for Admin By Request.

Following installation of the Mac 5.0 endpoint client, the following apps need full disk access:

  • adminbyrequest - The main app for enabling Admin By Request endpoint client features, including the ability to drag a file over the ABR icon in the dock to elevate privileges.

  • Admin By Request System Extension (optional) - This app needs full disk access only if the system extension has been enabled. The extension app provides a range of functionality; the main feature being the ability to install an app by dragging its icon over the Applications folder (which also requires operating system version macOS 11+).

The procedure to enable FDA is slightly different for different macOS versions. The following steps describe how to enable FDA on Apple Macs running:

  1. On your Mac device, navigate to System Preferences > Security & Privacy > Privacy tab and select Full Disk Access from the list. You’ll need to supply your password to unlock and make changes.

  2. Select both adminbyrequest and Admin By Request System Extension in the list of apps (i.e. ensure the boxes are checked):

  3. Lock the tab to save changes and close the System Preferences window.

  1. On your Mac device, navigate to System Settings > Privacy & Security tab and select Full Disk Access from the list. You’ll need to supply your password to unlock and make changes.

  2. Select both adminbyrequest and Admin By Request System Extension in the list of apps (i.e. ensure the toggles are on):

  3. Close the System Settings window.

Users logged-in with administrator privileges see the following icon and options from the menu bar:

Users logged-in with standard privileges see a different icon and menu options:

To test that Admin By Request is working properly, login to a Mac as a standard user and attempt a task that requires elevated privileges (such as modifying Users/Groups) to test that the product is working.

Refer to Using Run As Admin and Requesting Administrator Access for more information on tasks that require elevated privileges.

Multiple endpoint installation (automated via MDM)

This procedure describes how to install the Admin By Request Mac client on multiple endpoints using an MDM such as Jamf or Intune. The examples here use Jamf but the same Code Requirements can be used with any MDM.

NOTE:

For the Mac 5.0 client, we supply two configuration files to help with allowing the Admin By Request System Extension and enabling Full Disk Access for two apps. These are:

  1. AdminByRequest - System Extension.mobileconfig (optional)

  2. AdminByRequest - FDA PPPC_v2.mobileconfig

Download both in a zip file here.

These configuration files must be deployed in your MDM scripts before installing (or upgrading to) Admin By Request Mac 5.0. Failure to do so means the new features in the Mac 5.0 client will not work.

The important step in this procedure is the last one - deploy the config profile. Skip the rest of this procedure unless you want to understand how the Admin By Request config files were created.

The config files supplied were built in Jamf as follows:

  1. In Jamf, go to Computers > Configuration Profiles.

  2. Create a new profile and configure it as follows:

    1. Name: give the profile a name that helps explain what application it is giving rights to. In this example, we use ABR - PPPC.

    2. Category, select Applications.

    3. Distribution Method, select Install Automatically.

    4. Level, select Computer Level.

  3. Navigate from the General tab to the Privacy Preferences Policy Control tab:

    1. Identifier, enter /Library/adminbyrequest/adminbyrequest.

    2. Identifier Type, select Path.

    3. For Code Requirement, enter the following line of code:

      Copy 
      anchor apple generic and identifier "com.fasttracksoftware.adminbyrequest.extension" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = AU2ALARPUP)
      IMPORTANT:

      The code snippet is all one line. Use the Copy button in the top right corner of the code box to copy the code to the clipboard.

      For example:

    4. Under App or Service, select SystemPolicyAllFiles and under Access, select Allow:

      Under App or Service, select Accessibility and under Access, select Allow.

    5. For Code Requirement, enter the following line of code:

      Copy 
      identifier "com.fasttracksoftware.adminbyrequest" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = AU2ALARPUP
      IMPORTANT:

      The code snippet is all one line. Use the Copy button in the top right corner of the code box to copy the code to the clipboard.

      For example:

    6. Save the profile.

  4. Deploy the profile using Jamf (or your MDM) to allow the System Extension and enable FDA for all your macOS endpoints.

This procedure describes how to create and deploy an Admin By Request installation package.

Make sure that deployment of the installation package comes after deployment of the Admin By Request config files.

  1. Sign-in to your Admin By Request account at https://www.adminbyrequest.com/Login.

  2. Download the Mac client from the Download page and store the client file in a suitable temporary location.

  3. In Jamf, go to Settings > Computer Management > Packages.

  4. Click New and enter a Display Name (e.g. ABR 5.0.0).

  5. Click Choose File and browse for the PKG downloaded from the ABR portal:

  6. Click Save.

  7. Now create a new policy in Jamf.
    Enter the Display Name from step 3 above and choose the relevant trigger for your deployment:

  8. Open Packages, and click Configure.

  9. Select the package just created and click Save.

  10. In Scope, choose the devices to which you want to deploy the ABR client.

  11. Deploy the package.

Users logged-in with administrator privileges see the following icon and options from the menu bar:

Users logged-in with standard privileges see a different icon and menu options:

To test that Admin By Request is working properly, login to a Mac as a standard user and attempt a task that requires elevated privileges (such as modifying Users/Groups) to test that the product is working.

Refer to Using Run As Admin and Requesting Administrator Access for more information on tasks that require elevated privileges.

Upgrading Admin By Request

You can manually upgrade any client immediately by simply installing the latest version, although upgrading endpoint client software occurs automatically when new versions are released.

Deploying new releases

Admin By Request software updates are deployed by our Auto-Update process. However, when we release a new version we do not deploy it right away to all customers via auto-update. This is simply to mitigate any issues that arise after beta testing.

Our rule-of-thumb is to activate auto-update of new releases within 4 - 8 weeks of release, but this is subject to change, depending on feedback and any potential issues that might arise.

Contact us if you wish to receive the latest version right now. You can also raise a support ticket requesting the latest update.

Refer to the Download Archive for previous versions of Admin By Request.

NOTE:

If your Macs are not auto-updating to the latest version of Admin By Request, check the currently installed version on your endpoints. There was an auto-update problem with macOS version 3.2.1 - any Macs running that version of ABR will need to be manually updated.

The problem has been fixed in later versions of Admin By Request (macOS client).

For more information

Refer to Synchronizing Clients with the Portal for a description of how endpoint clients communicate with the portal inventory.

Refer to Release Notes (macOS) for details on what is covered in each new release.

Uninstalling Admin By Request

IMPORTANT:

If managing macOS endpoints using an MDM (e.g Intune, Jamf, Workspace ONE etc.), a post-uninstall script might be needed to revert at least one user account to admin permissions on each affected endpoint after completing the uninstall steps below.

This will be required only if all accounts have been downgraded to standard users. Check your Mac Settings in the portal (Lockdown > Admin Rights). If setting Revoke admin rights is On and there are no excluded accounts, then all accounts on each managed endpoint will have been downgraded.

Once Admin By Request is removed, the post-uninstall script needs to promote at least one account to admin permissions. Refer to (external) page Script to revoke or grant admin rights to standard users in macOS for an example.

The following procedures describe three ways to uninstall Admin By Request on a Mac:

These procedures are not sequential - pick one or a combination of all three, depending on your requirements.

  1. .

    The first few steps in this procedure require access to the portal.

    1. In the Admin By Request portal, navigate to the Inventory  page and identify the device on which to perform the uninstall.

    2. Locate the device in the inventory list - in the PIN column, click PIN for that device (columns can be switched around - the PIN column in your portal might not be the right-most column):

    3. Click tab UNINSTALL PIN and then click button Generate PIN:

      Note that clicking UNINSTALL PIN also displays a list of previous uninstall events on this computer (below the Uninstall Pin Code  window):

    4. Copy the PIN.

    5. Back on the device on which you want to uninstall Admin By Request, go to the About  panel (i.e. select the Admin By Request icon from the top menu bar and click About Admin By Request).

    6. In the Uninstall  window, select Uninstall from the left button group, enter the PIN copied from the Portal, and click Uninstall:

  2. In this example, Remove ABR  is the script and Remove ABR TEST  is the policy.

    1. Create a script in Jamf.
      Go to Settings > Computer Management > Scripts and click New Script.

    2. Enter a name for the script and open it:

    3. For Mode, select Shell/Bash, and enter /Library/adminbyrequest/uninstall:

    4. Click Save to save the script.

      The next step is to create a policy for deployment of the uninstall script.

    5. Enter a display name for the policy and choose an appropriate trigger for your deployment:

    6. Open Scripts, and click the + symbol to add:

    7. Add your uninstall script and click Save.

    8. Scope deployment of the script to the correct devices:

  3. .

    Uninstallation using sudo is straightforward for an admin user and simply requires executing an uninstall program once sudo is authorized.

    NOTE:

    The program cannot be run by a standard user during an Admin By Request administrator session. You need to log in as an admin user and also check/modify certain Mac settings in the portal.

    1. Login to the portal and go to Settings > Workstation Settings > Mac Settings.

    2. Select Lockdown in the vertical menu at left and check the Excluded accounts list.

    3. If your admin account is in the Excluded accounts list, continue with the next step. If your account is not in the list, add it and click Save. This must be an account with administrator privileges.

    4. On the Mac(s) to be uninstalled, log in with an account in the list. If you are already logged in, log out and log back in again.

    5. Run the following program on the Macs to be uninstalled:

      sudo /Library/adminbyrequest/uninstall

User rights after installation

When a user logs on, the account is downgraded from Admin to Standard User unless:

  • You have turned off Revoke Admins Rights in the portal settings (EPM > Settings > WindowsMacLinux Settings > Lockdown > ADMIN RIGHTS).

  • Also under Revoke Admins Rights, the user is in the list of Excluded accounts.

  • The computer is domain-joined and the user is a domain administrator.

Please refer to Supplementary Technical Information for more information.

Tamper Prevention

When a user initiates an administrator session, the user’s role is not actually changed from user to admin. The user is granted all administrator rights, except the right to add, modify or delete user accounts. Therefore, there is no case where the user can create a new account or change their own role and become a permanent administrator.

The user also cannot uninstall Admin By Request, as the only program, to keep the administrator session open forever. Furthermore, all settings, configuration and program files are monitored during administrator sessions. If the user tries to remove or change any of the Admin By Request files, these are restored straight away and the attempted activity is logged.

Mac Performance after Installation

When users are not using Admin By Request, it does not consume resources, except for a brief daily inventory and settings check.

Logging

Client activity and errors are logged in file /var/log/adminbyrequest.log.