Here again your favorite Random Dude,
Hope everything has been going well for everyone. Recently I was tasked with running an OVAL scan on all our macOS devices, I found that if they have JDK 17 or newer OVAL won't work. KACE Support told me that this is expected as it will only work with JDK 16, so obviously, my next task was to get that version of JDK on every machine.
How to confirm that OVAL doesn't work, you run your OVAL against your devices and you will get this…
OK so let's get to work.
Our Frist step is to get a list of all machines having that newer version of the JDK as we don't need/want to target our entire inventory (assuming a big amount of macOS devices).
To do this we need to create a Custom Inventory Rule (CIR for short) to gather that data.
Code from the image
ShellCommandTextReturn(java -version 2>&1 >/dev/null | grep 'java version' | awk '{print $3}' | tr -d \")After the inventory runs on our devices we will see the CIR under the "Installed Programs" of each device.
Under the Custom Inventory Fields, we will also see the result of our CIR
Now that we have (will have) all devices marked with our CIR we just need to create a simple Smart label to mark the machines.
We need to force the inventory to run again (or wait for it) so the label can be assigned to all the devices.
Lastly, we create an Online Shell Script from the Scripting section of the SMA.
In the "Deploy" section we add our label.
On the Dependencies, we add the JDK 16.x pkg and on the Script, we add the following
#!/usr/bin/env bash
rm -rf /Library/Java/JavaVirtualMachines/
rm -rf /Library/PreferencePanes/JavaControlPaneel.prefPane
rm -rf /Library/Internet\ Plug-ins/JavaAppletPlugin.Plugin
rm -rf ~/Library/Application\ Support/Oracle/Java
installer -pkg /Library/Application\ Support/Quest/KACE/data/scripts/66/JDK\ 16.0.2.pkg -target /
Be sure to modify the script ID on the last line of the script matches with the script ID from the URL (tip use "adminui").
After you run the script on your mac devices an inventory should remove the devices from the smart label and therefore the script should not run again on its own.
I have exported the script so you can import it and follow the last part of modifying the script ID. Download it from here. (from my Mega account).
If you have any questions or comments let me know in the comments.
Comments