Skip to main content

Hi everyone,

I’m in the process of cleaning up a previous school system’s JAMF instance, which unfortunately lacked proper patch management. As a result, there are still devices running macOS Catalina and newer versions.

I’m looking for advice or best practices on automating OS upgrades. While I’ll address the specifics of communication with my new manager separately, I’d really appreciate hearing from anyone who has dealt with a similar situation—particularly those without a dedicated team to handle the task.

Thank you in advance!

I would highly recommend the erase and install script on GitHub, has straightforward documentation and can be easily integrated with jamf. After the devices are on current OSes, you then you DDM style upgrades or nudge / SUPER ot encourage users to stay current. check out, 

 

https://github.com/grahampugh/erase-install

 

hope that helps.

If you are dealing with anything older than around macOS 13.3 you want to wipe and load. For Catalina this can be done using the software update binary from the macOS installer, but its still best to go in to recovery and just wipe and load. There are other tools like erase install which ​@mschlosser referenced, but trying to go up that many versions of macOS can be challenging for any automation. 

There are so many management differences between Catalina and later machines, that I agree that wiping older devices is the best bet. Where you have classroom devices, that’s probably easy. If you have one-to-one devices, that’s probably more difficult. You’ll be limited to using older versions of tools like erase-install (which despite the name can be used for a non-destructive OS upgrade). 

I tend to divide this work up by finding the largest group of computers that I can upgrade in one shot, so for instance everything that is running Sonoma that you can bring current. If you’re cloud-hosted, then the DDM software updates is the best bet because you can schedule them. If you’re on-prem, then DDM still works well but you don’t have the scheduling option.

Then I work toward the more difficult/edge cases.

If you don’t have any reporting on OS version compatibility, then you might think of setting that up.

Check your policy and profile scoping. You want to make sure that any profiles that apply only to a specific macOS version or later are only applied when that version is actually installed. For an upgrade campaign like this, I find it helpful to add an Inventory policy that runs on startup to catch the new OS version at first boot.

Good luck! We just reclaimed a Mountain Lion machine in the last few months, so I know the pain.

Terms & ConditionsCookie settings