Jamf Pro admins with “View Disk Encryption Recovery Key” privilege

During a recent internal audit, we were asked to provide a list of Jamf Pro administrators who have rights to view a computer’s FileVault Recovery Key.

If you have more than a few Jamf Pro admins, this task can prove tedious.

Hats off to @dacschumacher for the following SQL queries (some of which were written with extremely little real-world data).

Jamf Pro Administrators with “View Disk Encryption Recovery Key” privilege

SELECT username 
FROM   users 
WHERE  user_id IN (SELECT user_id 
                   FROM   user_roles 
                   WHERE  privilege = 'View Disk Encryption Recovery Key');

Jamf Pro Groups with “View Disk Encryption Recovery Key” privilege

SELECT group_name 
FROM   user_groups 
WHERE  group_id IN (SELECT group_id 
                    FROM   user_group_roles 
                    WHERE  privilege = 'View Disk Encryption Recovery Key');

Jamf Pro Administrators who have viewed a computer’s Disk Encryption Recovery Key

(My personal favorite)

SELECT From_unixtime(ja.audit_when DIV 1000) AS 'DateStamp', 
       ja.audit_who                          AS 'User Name', 
       c.computer_name                       AS 'Computer Name', 
       ja.child_object_id                    AS 'Computer ID' 
FROM   jss_audit AS ja 
       JOIN computers AS c 
         ON c.computer_id = ja.child_object_id 
WHERE  ja.audit_what_class_name = 'FileVault2ComputerKey' 
ORDER  BY datestamp ASC;