Suppress setup assistant after updates installed

What operating system are the kiosks running? there is a very good chance that you modify some plists and have them deployed to the machines so once they restart, they skip the setup assistant stuff.

They are a mixture of El Capitan, Sierra and High Sierra Macs. Our Helpdesk folks advised that a second reboot fixed it, so I'm thinking a post-patch policy to reboot might be in order?

You can modify /Users/USERNAME/Library/Preferences/com.apple.SetupAssistant.plist for the Kiosk machines.

Create a launchdaemon & a simple shell script. Have the launchdaemon call the simple shell script at boot, tell the shell script to run sudo jamf policy -event POLICYNAMEHERE. Package both the launchdaemon and shell script and deploy it via a policy to the machines that you are updating, have it deployed on logout / after the update.

Have the policy referencing "POLICYNAMEHERE" that is called in the shell script deploy a modified version of the com.apple.SetupAssistant.plist to the /Users/USERNAME/Library/Preferences/ directory with all the flags set to true. Add a script to that policy to delete the LaunchDaemon and script it calls after the policy is ran.

You can either copy com.apple.SetupAssistant.plist yourself or modify the flags from <false/> in the plist to <true/> & modify <key>RunNonInteractive</key> & <key>SkipFirstLoginOptimization</key>. Again, instead of modifying the plist, you can most likely get away with just copying the plist from an already updated machine that boots and bypasses the prompts.

example >

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>DidSeeApplePaySetup</key>
    <true/>
    <key>DidSeeAvatarSetup</key>
    <true/>
    <key>DidSeeCloudDiagnostics</key>
    <true/>
    <key>DidSeeCloudSetup</key>
    <true/>
    <key>DidSeeSiriSetup</key>
    <true/>
    <key>DidSeeSyncSetup</key>
    <true/>
    <key>DidSeeSyncSetup2</key>
    <true/>
    <key>DidSeeTouchIDSetup</key>
    <true/>
    <key>DidSeeiCloudLoginForStorageServices</key>
    <true/>
    <key>DidSeeiCloudSecuritySetup</key>
    <true/>
    <key>FDECSLVUUIDs</key>
    <array>
        <string>0C20FEC7-754B-45BC-B6D8-F828400EB40E</string>
    </array>
    <key>GestureMovieSeen</key>
    <string>none</string>
    <key>LastCacheCleanupProductVersion</key>
    <string>10.11.4</string>
    <key>LastCacheCleanupStillRunning</key>
    <false/>
    <key>LastPreLoginTasksPerformedBuild</key>
    <string>16G29</string>
    <key>LastPreLoginTasksPerformedVersion</key>
    <string>10.12.6</string>
    <key>LastSeenBuddyBuildVersion</key>
    <string>15G31</string>
    <key>LastSeenCloudProductVersion</key>
    <string>10.12.6</string>
    <key>LastSeenSyncProductVersion</key>
    <string>10.11.6</string>
    <key>PreviousBuildVersion</key>
    <string>0</string>
    <key>PreviousSystemVersion</key>
    <string>0.0.0</string>
    <key>RunNonInteractive</key>
    <false/>
    <key>ShowKeychainSyncBuddyAtLogin</key>
    <true/>
    <key>SkipFirstLoginOptimization</key>
    <false/>
</dict>
</plist>

Thanks a lot, some great food for thought. Appreciate the help.