i tried that:
<restricted_software>
<general>
<name>Restrict High Sierra</name>
<process_name>Install macOS High Sierra.app</process_name>
<match_exact_process_name>true</match_exact_process_name>
<send_notification>true</send_notification>
<kill_process>true</kill_process>
<delete_executable>true</delete_executable>
<display_message>High Sierra is not yet supported, check Self Service after public release.</display_message>
<site>
<id>-1</id>
<name>None</name>
</site>
</general>
<scope>
<all_computers>false</all_computers>
<computers/>
<computer_groups>24</computer_groups>
<buildings/>
<departments/>
<exclusions>
<computers/>
<computer_groups/>
<buildings/>
<departments/>
<users/>
</exclusions>
</scope>
</restricted_software>but it doesn't work