Accidental upgrade to Mojave?

[jtrant]

Hello,

I have a user that was running macOS Sierra 10.12.6. He ran an App Store check for updates and somehow Mojave was installed, even though we have a Restricted Software record for "Install macOS Mojave.app". I can't block OSInstaller as we're actively encouraging Sierra users to upgrade to High Sierra.

While I'm not sure how exactly this happened, or if the user specifically ran the Mojave upgrade from the App Store, I'm wondering if anyone can make sense of what I'm seeing:

• Unclear if the user had changed "Install macOS Updates" under App Store > Preferences
• blacklist.xml timestamp is AFTER his upgrade to Mojave, even though we haven't made any changes to the restricted software record for months
• Hardware & Software History only shows items being added after upgrade to Mojave, nothing before (also indicates that comms to Jamf was broken?)
• The last scheduled update scan just before his upgrade showed:

          SoftwareUpdateCount = 0;
      SoftwareUpdatesAvailable = 0;

  I then see this in installer.log and the installation proceeds, upgrading him to 10.14.0:

  Oct 28 11:16:07 [ComputerName] softwareupdate_notify_agent[6400]: appstoreupdateagent notified
  Oct 28 11:16:07 [ComputerName] softwareupdate_notify_agent[6400]: AssertionMgr: Cancel com.apple.softwareupdate.NotifyAgentAssertion-UpdatesAvailable assertion for pid 6400, id 0x96D8
  Oct 28 14:31:30 [ComputerName] InstallAssistant_springboard[27307]: Springboarding to: /Applications/Install macOS Mojave.app/Contents/MacOS/InstallAssistant
  Oct 28 14:31:30 [ComputerName] InstallAssistant_springboard[27307]: argv[0]: InstallAssistant
  Oct 28 14:31:30 [ComputerName] InstallAssistant_springboard[27307]: argv[1]: -psn_0_2388551
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: InstallAssistant build: 532
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: No compatibility bundle on this version of macOS. Will assume compatible.
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Hardware: MacBookPro14,3 @ 2.90 GHz (x 8), 16384 MB RAM
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Running OS Build: Mac OS X 10.12.6 (16G1510)
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: __CF_USER_TEXT_ENCODING=0x2625B0DF:0x0:0x2
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: TMPDIR=/var/folders/4r/kv1qx9wn0yxbj_rvgv9by3ccl2bc6z/T/
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: HOME=/Users/[UserName]
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: SHELL=/usr/local/bin/zsh
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.K13jMPvOov/Listeners
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: Apple_PubSub_Socket_Render=/private/tmp/com.apple.launchd.WWaWXYjdOe/Render
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: DISPLAY=/private/tmp/com.apple.launchd.0WUYZ3ndfz/org.macosforge.xquartz:0
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: PATH=/usr/bin:/bin:/usr/sbin:/sbin
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: LOGNAME=[UserName]
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: XPC_SERVICE_NAME=com.apple.xpc.launchd.oneshot.0x1000003e.InstallAssistant_springboard
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: COMMAND_MODE=unix2003
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: USER=[UserName]
  Oct 28 14:31:30 [ComputerName] InstallAssistant[27307]: Env: XPC_FLAGS=0x0
  Oct 28 14:31:30 [ComputerName] osinstallersetupd[27309]: OSISSoftwareUpdateController: Using catalog (source: GM Default): https://swscan.apple.com/content/catalogs/others/index-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
  Oct 28 14:31:30 [ComputerName] osinstallersetupd[27309]: mountDiskImageWithPath: /Applications/Install macOS Mojave.app/Contents/SharedSupport/InstallESD.dmg

Any suggestions would be appreciated! Trying to ensure this doesn't snowball and result in a ton of users on an unsupported OS.

Thanks,
Justin.

[andrew_nicholas]

Might be helpful to do a restore of a Database backup to a test VM for the day(s) before he upgraded and look at his machines entry. You should be able to see if it was in the restricted software scope or if he was even communicating. Doesn't really answer the question but it might shine some light on if this was a one-off or something larger.

[jtrant]

I think I figured it out. It looks like Jamf communication was broken (blacklist.xml not present, Hardware and Software history empty).
The user got the regular "Click here to install Mojave" since the OS had cached, and ran it. We're pushing a package that deletes LibraryBundlesOSXNotification.bundle and hides the update "macOSInstallerNotification_GM" which creates the bundle in the first place.

Fingers crossed that helps, thanks Andrew for your help! I'll post here if I find any more interesting tidbits.