Skip to main content
Solved

Force Xprotect to update?

  • December 11, 2020
  • 7 replies
  • 110 views
F
Forum|alt.badge.img+7

Hi,

How do you force an Xprotect version update?

Trying: 

softwareupdate --background-critical

outputted the following:

softwareupdate[92845]: Triggering background check with forced scan (critical and config-data updates only) ...

But running:

defaults read /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist CFBundleShortVersionString

shows an older version of XProtect

For our labs we updated to 10.15.7 using the Combo and Supplemental PKGs but the Xprotect version remained an old version.

We like to control the software update process so we have everything unchecked in Software Update

Not sure if that has something to do with Xprotect being unable to update even when running softwareupdate --background-critical from the Terminal.

Best answer by fgonzale

@mvu thanks for the feedback it pushed me towards an answer. In the end the final piece was 

softwareupdate --background --include-config

in combination with the following Software Update PreferencePane configuration

This Software Update PreferencePane configuration is displayed after running the following (assuming nothing was selected before):

/usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool true
/usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool true
/usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist ConfigDataInstall -bool true

Basically if I tried to run

softwareupdate --background --include-config

without the above configuration for Software Update then the XProtect definitions would simply not update. Once I at least re-enabled the Mac's ability to check and download updates then running softwareupdate --background --include-config would finally grab the latest Xprotect data.

    7 replies

    mvu
    Forum|alt.badge.img+20
    • mvu
    • Jamf Heroes
    • 963 replies
    • December 11, 2020

    Does this work?

    a) softwareupdate --background --include-config
    b) softwareupdate --background --include-config-data

    If you want to install ALL Mac updates, including Xprotect and MRT:

    c) softwareupdate --ia --include-config-data

    F
    Forum|alt.badge.img+7
    • fgonzale
    • Author
    • Valued Contributor
    • 62 replies
    • Answer
    • December 17, 2020

    @mvu thanks for the feedback it pushed me towards an answer. In the end the final piece was 

    softwareupdate --background --include-config

    in combination with the following Software Update PreferencePane configuration

    This Software Update PreferencePane configuration is displayed after running the following (assuming nothing was selected before):

    /usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticCheckEnabled -bool true
/usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticDownload -bool true
/usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate.plist ConfigDataInstall -bool true

    Basically if I tried to run

    softwareupdate --background --include-config

    without the above configuration for Software Update then the XProtect definitions would simply not update. Once I at least re-enabled the Mac's ability to check and download updates then running softwareupdate --background --include-config would finally grab the latest Xprotect data.

    mvu
    Forum|alt.badge.img+20
    • mvu
    • Jamf Heroes
    • 963 replies
    • December 18, 2020

    If you wanted to keep those unchecked for control, you can download the Xprotect and MRT packages directly and upload to Jamf to push. There are a few ways to get the packages if you want to go that route.

    F
    Forum|alt.badge.img+7
    • fgonzale
    • Author
    • Valued Contributor
    • 62 replies
    • December 31, 2020

    @mvu ah, you're right I could have just downloaded the pkgs for that. I think in the past I've installed things on a build machine and then looked at the install.log to figure out the URL path for the installed pkgs.

    Or is there a better way of extracting/parsing for the pkgs in Apple's software repository?

    mvu
    Forum|alt.badge.img+20
    • mvu
    • Jamf Heroes
    • 963 replies
    • January 13, 2021

    Yes, you can find the URL in the Console. You can also use Terminal and the softwareupdate -d command. I explain how I did this with Safari that in the link below. Someone mentioned the app SUS Inspector as well, which saves some work on digging for the URL.

    Safari DL

    mfletch
    Forum|alt.badge.img+8
    • mfletch
    • Contributor
    • 37 replies
    • December 12, 2023

    @fgonzale I'm struggling to get this to work and all of our macOS devices are on the latest version of macOS (14.1.2..... I realize 14.2 was released yesterday...)  but a handful of devices have an old version of XProtect for some reason. Do you happen to have a script that works to update XProtect? I tried running softwareupdae - d but no luck, but I think that's just because it's downloading the update, but not actually installing the update and I'm not to sure how to kick off the install.

    pete_c
    Forum|alt.badge.img+16
    • pete_c
    • Honored Contributor
    • 258 replies
    • January 8, 2024

    @fgonzale I'm struggling to get this to work and all of our macOS devices are on the latest version of macOS (14.1.2..... I realize 14.2 was released yesterday...)  but a handful of devices have an old version of XProtect for some reason. Do you happen to have a script that works to update XProtect? I tried running softwareupdae - d but no luck, but I think that's just because it's downloading the update, but not actually installing the update and I'm not to sure how to kick off the install.


    Create a new configuration profile with a Software Update payload that enforces automatic installation of configuration data and system data files.  

    Alternatively, package and deploy Eclectic Light's silnite utility, create a smart group based on XProtect Definitions Version (Computer Inventory > Security, currently version 2177), then create a policy scoped to that group to execute command "silnite au" (by default it installs to /usr/local/bin/) to check for and install updates.


    Terms & ConditionsCookie settingsAccessibility statement