search

mpanighetti / install-or-defer

A framework for prompting users of Jamf Pro-managed Macs to install Apple software updates.
Apache License 2.0
147 stars 28 forks source link

Install or Defer prompting users to install Sonoma when it is deferred by MDM #102

Closed justintrant closed 10 months ago

justintrant commented 10 months ago

Good morning @mpanighetti,

Even though we're deferring Sonoma with forceDelayedMajorSoftwareUpdates and enforcedSoftwareUpdateMajorOSDeferredInstallDelay, there are instances where the endpoint does not respect this, and shows Sonoma as an available update in Software Update.

Would it be possible to add an if statement to the UPDATE_CHECK function that excludes Sonoma on Macs running Ventura or below, similar to what was added for Ventura on Macs running Monterey?

if [[ "$OS_MAJOR" -lt 14 ]]; then UPDATE_CHECK=$(echo "$UPDATE_CHECK" | /usr/bin/grep -v "macOS Sonoma") fi

Thanks a lot, Justin.

mpanighetti commented 10 months ago

I can make that change (and remove the Ventura bit since we're well beyond the maximum 90 day deferral period for macOS Ventura), but note that this will only prevent macOS Sonoma from being listed as an available update in the jamfHelper alert; if it's available to install and it requires a restart, the script will install it alongside any other available updates.

The issue you're describing is a macOS bug (though Apple disagrees) that makes a major macOS upgrade get presented to the Mac as a minor update in some situations. From what I understand, it happens if your current macOS (presumably Ventura) is fully updated (13.6 in this case); Sonoma will get downloaded as a delta update to make the download smaller, but the tradeoff is that major macOS update deferrals will be bypassed. The workaround in this case is to also defer minor updates (maybe for a smaller time period) until you can allow the major macOS upgrade in your environment, at which point you can remove your deferrals and allow upgrades.

I'll add a note calling out this limitation and the recommended workaround in the README alongside this change, PR is forthcoming. Thanks for flagging this!

justintrant commented 10 months ago

Thank you so much. We have switched to manual updates across the board, so the aim is to prevent Sonoma from being displayed in the dialog.

As always, much appreciated.