@ahopkins - If they're just having you move the loginwindow.plist somewhere, basically just setting it aside, something that's being applied to it must just be either damaging it or adding something that is confusing the installer. Perhaps just doing that en masse would make sense if it can be tested and verified to be the issue. The big thing would be thoroughly testing it to understand what the issue is with the file that's making the login process throw fits. One of the most productive presentations I ever saw at WWDC was titled "From power-on to login". It talked about all of the processes that start, the order, and the rights each had. That's important in the sandboxed world of OS X now.

I imagine that your users have admin rights because you want them to be able to maintain their own computers? Otherwise, it's really just users being users and exercising their 'rights' in a programatic and human sense.

It's more of a culture. In our environment, we have about 3000 iOS devices and we sent an email asking people to not update to iOS 8 right away. We didn't actively block it but instead gave people information. We had about 70 or so people update and a few had issues. Culture is hard to change though and 25 posts on a JAMFNation thread won't help or fix that. For us the culture has been a 6 to 8 year process that has been painful at times but has netted us awesome results. Best of luck to you and we're here to help! I appreciate that this group endeavors to answer the 'real' question and not just the 'asked' question... That makes all of us stronger and better mac admins.

We have about 1000 iPads K-8, I was working with a kindergarten class, I turned to see a little one hit the iOS update before I could stop her... Out done by a 5 year old...

Our Macs are in the high school,, and today the update wasn't an issue, will address this again on Monday.

@ahopkins, if your users are admins & you have no SUS.. You'll be playing whack-a-mole until you resolve the root cause issue. (Which is what @Banks was getting at).

You might be able to do the com.apple.loginwindow copy as a policy triggered once per Mac running 10.9.5 at startup.

Now as to the issue itself, can you post a copy of your com.apple.loginwindow.plist from a 10.9.4 mac. Also from a 10.9.5 Mac that has had the "fix" applied.

Students are not users, but they can install the software update. We tested this on afew student computers... We click on the update, it asks for Apple ID, we hit. Cancel it updates.. Just for the system updates, not apps.. Strange but true..

@ahopkins, ugh. This thread has got convoluted along the way.

So, if the students are not admins.. Then no need to worry about them downloading updates from Apples support site.

Do you allow students to install their own apps via the App Store?

If not, you can restrict the App Store & stop Software Update from checking.

That command is listed here: https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man8/softwareupdate.8.html

It's obviously not a good idea to not install updates, but may be a temp measure until you find out what's causing the issue for you.

Yes, I haven't had a thread expand like this.

So, students are not admins. For app updates, I'm doing the update and installing via policy, self service.

This 10.9.5 update we found students can click update, and it lets them update it, no admin password needed. Maybe I missed a step in the set up when I imaged, don't know. Just like our iPads, students can hit the update gear and the iPad updates, doesn't look that can be blocked.

@ahopkins][/url, as I asked before. Do your students need access to the App Store?

No, not at this time.

@ahopkins, then why not block the App Store?

@ahopkins and @bentoms - we block the app store here for this reason. You no longer need admin rights to do software updates. Any apps or software updates our students need, we push.

Your 10.9.5 Black screen... are you enforcing a policy banner on your laptops? Are the machines bound to a directory server? I actually had this issue prior to 10.9.5, and discovered there was an issue with the Policy Banner and the computers running OS Updates through Power Nap.

So I'm guessing that outsourcing to a consulting firm to come in and resolve this issue is out of the question?
This sounds like it is probably not a great experience for the end users or teachers/leadership at the moment. If it was me, I'd probably spend the bucks to get it fixed as soon as possible. Perhaps learn about the cause and fix after when users are not being impacted. You could also leverage this problem as a reason for your employer to spend money on your PD and perhaps have you attended some Apple/Jamf training courses.

Think you're being a bit harsh Don cross posting twitter and IRC posts.....Everyone needs to vent. Have you never got off the phone to someone after being polite to them and then said wow what a d*ckhead? Stones and glasshouses and all that yada yada yada