Disabling Automatic Updates

[pchrichard]

Is there an easy way to untick the checkbox for "Automatically keep my Mac up to date"

I've created a plist for the options I'm interested in applying, but these only apply successfully when this box is unticked.

In the main software update menu, there is a box for "Automatically keep my Mac up to date", when you click this and then click Advanced, all Advanced options are selected. When this is then deselected, the manage options I desire are selected.

Essentially, I want updates to be downloaded but not installed unless they're critical, but bizarrely, there doesn't seem to be an easy way to do this with Jamf?

[talkingmoose · Accepted solution]

Here's a script I've put together to help some customers. You'd need to set any items you want UNticked to FALSE instead o TRUE.

You can add the script to your Jamf Pro server and then deploy it to your Macs via policy.

https://gist.github.com/talkingmoose/53a131b2324c0e0945a573dfc3f230f4

[pchrichard]

This worked - thank you.

[rcole]

Thanks for this @talkingmoose !!!

[admindaly]

@talkingmoose Thank you. Was going to use your script but what are the last two commented lines in your script about?

[talkingmoose]

@admindaly, when using the defaults command to create plists, the files are formatted as binary instead of plain text. I left those two lines there in case Apple some day enabled these settings to be manageable via Configuration Profile.

In macOS Catalina, they did. And in Jamf Pro 10.15, Jamf added a new Configuration Profile payload to manage these settings.

[McAwesome]

Out of curiosity, what does the ConfigDataInstall option do? The others seem straightforward enough, but I'm not quite clear on this one.

[rqomsiya]

^^ installs yara/mrt malware files and definitions. Example: when zoom exploit was identified these were automatically blocked by apples the updated yara files.

[MasterNovice]

We are transitioning Mojave to Catalina currently in our org. My goal is to prevent non-admin users being prompted for admin credentials on updates that we approve and deploy through Jamf. (I think this is what we need for the Mojave users.)

For Catalina machines, we can deploy the Software Updates payload and uncheck "Allow beta", "Check for Updates", and "Download New Updates when Available". Do the install options on this payload still need to be checked for the administrative request from Jamf to download and install correctly when we push them out? In other words, if I set all of these to false, and then did a download and install for a system update on a device configured with these plist options false, would the system still get and install the updates?

For Mojave then we would want to use these plist writes to manage the same options and at least set AutomaticCheckEnabled, AutomaticDownload, AutomaticallyInstallMacOSUpdates, and AutoUpdate to false. Is that correct? (Apologies in advance, very new to iOS and MacOS management in general, and supervised management specifically. I rely on and appreciate greatly this community for its scenario based solutions!)

[tcam]

I think it's great that they're making it even easier, and more seemless to update. As well as give admins a way to delay updates to help smooth out the issues that can happen with new software updates.

Even with macOS 11.0, there are times when bugs / issues don't get fixed in 90 days, ignore was really useful in avoiding those 90+ day issues. I hope a long tearm soluion is found.