Best Practice for Easy Install?

Once you have the smart groups setup, you can create three separate policies for each version and then scope each policy to it's corresponding smart group. The users and support people would only see (if you use self service) the version that pertains to there smart group.

Thanks Sean!

Would there be a way to make this even easier? Let's say a Mac field support person needs to install SEP on a Mac. They would have access to policies or something more if it makes sense. Can I set something up where they would only need to click on one item (Install the correct version of SEP for my Mac button) and it would identify the OS and the corresponding version of the application to be installed automatically?

That’s what Sean has essentially said.

The end user or tech would only see the policy that relates to that OS smart group.

The other option could be

You could set the OS version in the package settings in JAMF admin

Then have the same policy for all. But with all three packages. Then when the binary goes to install all 3. Two will fail cause they don’t meet OS requirements.

The issue with this method is in policy logs and self service you see policy failure as it did not complete everything.

Thanks Rick,

I understand your explanation. We won't be using Self-Service on this install because it will be a required install on all Macs (I should have made that clearer). I thought that might not work correctly with Sean's solution.

My explanation just uses Self Service as the policy trigger. You can still make three policies scopes to the proper smart groups and have them execute at recurring check in or any other trigger you would like.

You could make a script that is called with a single policy, and have the script simply check the OS version on the Mac it's being run on, and then call the appropriate actual install policy (you would have 3 of these) using a custom event trigger. Simple example:

#!/bin/bash

OSvers=$(sw_vers -productVersion | cut -d. -f1,2)

case "$OSvers" in
    10.6|10.7)
    policyTrigger="install10.6-10.7"
    ;;
    10.8|10.9)
    policyTrigger="install10.8-10.9"
    ;;
    10.10|10.11|10.12|10.13)
    policyTrigger="install10.10-10.13"
    ;;
esac

/usr/local/bin/jamf policy -event "$policyTrigger"

You would need to create the 3 policies that use each of the above custom event triggers, with no other triggers assigned, and scoped appropriately. And have the correct pkg install in each one naturally. Then use the script above, or something like it for the main policy. The script will run, check the OS and set the appropriate custom trigger and then call that policy.

That's truly amazing but beyond my expertise at this point being very new to Jamf! I can't tell you how easy that is to do in Altiris but we are trying to do everything in Jamf now. Thanks for all the help, I will give Ricks method a try since it's all but done already.