Unfortunately it's broken. Here is the defect number from JAMF D-005395

Just as an FYI - they removed the commands from Maverick to enable it.

the ability to enable software update only mode in 10.9 via defaults write or modifying any plist file has been specifically removed. The only way to accomplish this task starting with 10.9 Mavericks forward is via a configuration profile.

Is anyone using restrict-store-softwareupdate-only in a configuration profile?
It does work as in it disables all tabs except "Updates", but the Updates tab itself won't load properly:

external image link

It does realize that there are updates (it shows the badge on the App Store icon), but the page won't load.
Same profile works as intended on 10.8

maybe in rumored 10.9.1 it will work?
You got farther than I did with the config profile, mine disabled all tabs :(

I've tried the Restrict App Store to software updates only, and it doesn't work. All my tabs are available including the App Store.

yep. we went back to blocking the app store with restricted processes until it's resolved.

I'm having the same results as Chris. After imaging the computer and applying the config profile, it disables all tabs except for the Updates, which is correct. It shows the badge icon that there are apps available, but the page never loads. I thought it was a firewall issue at first, but ML works fine.

Here's the weird thing, the exact same profile works fine if I do a clean install (not based off of an image). Maybe Mavericks doesn't like how the image was made???

This seems to be working now in 10.9.1:

external image link

Although the only Setting that shows up in the Profile is "Restrict Installs To Admin Users":
external image link

"Software Update Only" and "Disable App Adoption" are not shown, but the settings are applied.

@Chris Thank you!

Obviously it's just working via config profile. To modify the .plist doesn't work. I still have the problem, that sometimes App Store doesn't list the updates, although I know there are updates available. Any suggestions? @Chris think you had the same probs. How did you solve it?

same issue here fabsen83...

Also seeing this issue. Ive even tried creating a separate profile in Profile Manager and got the same result. Looks to me like an Apple issue. I've opened a case with Enterprise support.

@fabsen83 unfortunately this doesn't work consistently for us as well,
i couldn't really find a solution yet

@Chris][/url Ok, that's really sad. Especially there is no solution from Apple yet. So how are your users able to run SoftwareUpdate? I cannot leave my students with a full AppStore, because they install all free crap on their machines.

We're currently running Munki for Apple Updates:

http://code.google.com/p/munki/wiki/AppleSoftwareUpdatesWithMunki

Working for me via managed preferences.

We trigger manual updates via a policy anyway.

@Chris Thanks for the link. I'll look into it. Are you using your own SUS or Apple ones?

@franton Which OS are you running? I tried several solutions to get than running on 10.9.x and it did not work for me. Would you please share how you were able to get that running? Thanks!

@fabsen83 Use Casper's managed preferences. I'm on JSS v8.73.

System Level Enforced
Domain: /Library/Preferences/com.apple.appstore
Key: restrict-store-softwareupdate-only
Value: True
(that's key type boolean).

@franton ...and the client has 10.9.x installed? I used MCX to restrict appstore on 10.8.x clients as well successfully but not on 10.9.x.

Yes, exactly right. I'm not having an issue with this method at all.

But then for reasons to do with our infrastructure, i'm not using config profiles at all. Local MCX all the way.

@franton Don't know what I am doing wrong, but the MCX is not applied by my clients. App Store still has all features open.

Take a screenshot or two of how you've set things. Show me that and I can possibly point you in the right direction.

Any update on this? I also can't get it working on my 10.9.x machines, so I have App Store restricted completely.

@chlaird are you trying to make it so that your non-admin users can't update their software, or do you want them to be able to do that, but not be able to buy things from the App store?

I wanted to disallow my non-admin users from installing updates or buying apps, so I deployed a configuration profile and a script to implement it via policy (we're on 8.73 and we're not currently using MCX through Casper... long story). It alters the App Store so that an admin password is required to install apps or updates. It works well for us, but I'm not sure that's exactly what you want. What version are you using and are you using MCX?

We're looking for a way to block non-admins from buying/downloading apps, but to keep the "Updates" tab enabled. We're trying to find a better way to keep our labs "current", but an "emergency" where a user in class couldn't install the newest update made us realize it might be nice if users can do updates, but nothing else