Skip to main content

I’ve been running a script in our labs for the last couple of years to do macOS updates after caching the installer onto devices, the script is this:

/usr/bin/su -l ladmin -c "echo ADMINPASSWORD | /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/startosinstall --nointeraction --agreetolicense --forcequitapps  --user ADMINACCOUNT --stdinpass"

This has worked perfectly fine, and continues to work on our iMacs and Mac Minis, but when I’ve tried to update our MacBooks from Sonoma to Sequoia I’m being met with this bizarre message:

Result of command:

Error: You must be root to do this…

I don’t understand this at all, because as far as I was aware everything the Jamf binary does is already run as root. Is anybody able to shed any light as to why this is failing please?

Much thanks!

Not tested it here, but my copy of that command starts at the echo. The su command switches the user account that is running the rest of the command, in this case to a user called ladmin.

If they’re apple silicon, I’m not surprised by this. Those require a password. Take a look at the DDM Software updates with the schedule feature. Your mileage my vary but it may work for you.

If they’re apple silicon, I’m not surprised by this. Those require a password. Take a look at the DDM Software updates with the schedule feature. Your mileage my vary but it may work for you.

This was my thought.  The predefining command with the user defined and password shows that it’s for intel devices.  M devices won’t work like that.

Also, just use the software update commands via jamf and done and done.  Use MDM for what it’s meant for 😊

If they’re apple silicon, I’m not surprised by this. Those require a password. Take a look at the DDM Software updates with the schedule feature. Your mileage my vary but it may work for you.

This was my thought.  The predefining command with the user defined and password shows that it’s for intel devices.  M devices won’t work like that.

Also, just use the software update commands via jamf and done and done.  Use MDM for what it’s meant for 😊

For reference though I’ve used and continue to use this policy on Apple Silicon devices that aren’t MacBooks and it works absolutely fine. I’ve only experienced this on the MacBook Pros I’ve tried it on.

 

​@Fwatson Do you have FileVault active? That was an issue for us. The Bootstrap Token was not escrowed correctly and the Admin was not allowed to do Updates.

Open Terminal and switch to your Admin User.

sudo profiles status -type bootstraptoken

If the Answer looks like this, you might run some additional commands.

profiles: Bootstrap Token supported on server: YES
profiles: Bootstrap Token escrowed to server: NO

I would then recommend running those commands:

sudo profiles install -type bootstraptoken 
sudo profiles status -type bootstraptoken

After that Boostrap Token escrowed to server should be yes.

That’s worked for us. 

Terms & ConditionsCookie settingsAccessibility statement