Forcing updates using the new Software Update feature

[mrrobertbuss]

Is it just me or is this forced update feature not working for you too? Noth

Is it just my system or is this not working for you too? Updates do not get forced and we are all on Sonoma. 

[sdagley · Accepted solution]

WARNING! - PI116287 "Scheduled Software Updates (DDM) using Specific Versions Does Not Work" 

Apparently I was incredibly lucky that using a DDM Scheduled Update specifying version 14.2.1 actually worked because there is a bug in the current implementation that generates malformed DDM commands. Use the "Latest version based on device eligibility" or "Latest minor version" options to schedule an update instead.

This bug is present as of Jamf Pro 11.2.0, and reportedly will not be fixed until after Jamf Pro 11.3.0 is released.

[mrrobertbuss · Accepted solution]

Thank you for this. For me, this is the way to move forward on this issue. It may not be a solution for all. Resolving this ticket with this answer. 

[mrrobertbuss]

Sorry for the two sentences posted. Thought I deleted the first sentence but it showed up anyways. 

[red_beard]

I also haven't had success. My example is with my Mac Studio lab here. I was trying to get them to go from Ventura to Sonoma. I set it up to run about two weeks ago and not one machine out of 35 has updated. As far as I can tell there is no window into the process to see what's gone wrong or if it's actually trying to do anything. 

I fully accept I might be missing something obvious here, but I don't know what to do about.

[foobarfoo]

Your devices already need to be on Sonoma to set a deadline. Doing this for pre-Sonoma clients does nothing. You need to have a different update flow for these using the traditional options (download, install and restart).

[sdagley]

@mrrobertbuss Have you previously deployed a Scheduled Software Update request with a deadline further out? It appears that you need to cancel any pending Scheduled Software Updates before a new one will be recognized. You can do that by turning off the beta Software Update mechanism which will cancel all in-flight updates. You can then turn it back on and schedule your new update.

I'd also suggest you implement the two EAs from my https://community.jamf.com/t5/jamf-pro/extension-attributes-to-report-on-ddm-scheduled-macos-updates... post which will report the version and deadline for pending updates.

[mrrobertbuss]

Set up the deferral to kick in 1.9.24 at 8:00 am

[mrrobertbuss]

Nothing happened. Consensus is this works for some but not for others. 

[mm2270]

I've also had almost no luck getting the new Software Update functions to work.

I wasn't aware of the potential for pending scheduled requests interfering with any new ones. That seems like a silly flaw in the process. We should not need to be turning off and on features to get things to work, but I appreciate the heads up on that issue @sdagley regardless.

If I could have one wish in regards to macOS management, it would be for a truly reliable and easy way to deploy OS updates to my Macs again, that doesn't require a wing and a prayer, prompting (begging) users to install them or any user interaction. This mess we're in of Apple's making has been going on for so many years now. I'm so tired of having to explain to my management that getting these installed is so difficult.

[AJPinto]

This workflow still uses Apples MDM framework to manage OS updates. The problem is not so much JAMF, its more so Apples entire workflow for handling OS updates is flat out garbage.

If there is anything causing the update to fail, JAMF does not notify you. You must go to each inventory record individually and check. Even then, JAMF is relying on the data that Apple kicks back with the MDM framework which usually is nowhere near enough to troubleshoot an issue. I would suggest having the install.log from a few of the effected devices sent to you and looking over them. I'd wager you either have a network block, or a persistent app that is preventing the reboot as none of Apple's commands will actually force quit an app that does not want to quit.

TL;DR: JAMFs new Software Update panel is just putting lipstick on a pig, macOS updates are still just a pig.

About software updates for Apple devices - Apple Support

macOS Upgrades and Updates Using a Mass Action Command - Technical Paper: Deploying macOS Upgrades a...

ScheduleOSUpdateCommand.Command.UpdatesItem | Apple Developer Documentation

Get the OS Update Status | Apple Developer Documentation

[sdagley]

@AJPinto In my testing of DDM Scheduled Updates a Mac will restart at the scheduled time to complete the update even if there are applications open with un-saved documents. Have you found an application that can't be terminated that repeatedly prevents installation?

While I'm not exactly happy it's taken Apple this long to address the gaping hole in managing macOS updates that Big Sur introduced I am pleased with the introduction of DDM Scheduled Updates in Sonoma. Are there some rough edges at the moment with both the Jamf Pro and macOS parts for configuring and completing DDM scheduled updates? Yes, but for my environment it's working much better for ensuring Sonoma updates by a deadline than Nudge did for Monterey and Ventura. I'm optimistic that both Jamf and Apple will aggressively improve things over their next few releases, and we'll finally be able to cross "Provide reliable management of macOS updates" off the Mac Admins Wish List.

[sdagley]

To follow up on my comment that I'm optimistic DDM Scheduled Updates will truly be useful here are the current macOS Sonoma stats for my org:

macOS Sonoma 14.2.1 is being rolled out as our base macOS install so the majority of devices listed are upgrades from macOS Ventura, but for all that were already on Sonoma a DDM Scheduled Update was used to ensure the update to 14.2.1. Of the 3 Macs not yet on 14.2.1 one hasn't been online since the scheduled deadline, one hasn't been logged back into since the deadline, and the 3rd (showing as Unknown) is running the macOS 14.3 Release Candidate build.

[janthenat]

Just adding my experience, and apologizing for not fully reading all the previous posts ;^)

I've experimented with trying to perform the following two items using Software Updates, unsuccessfully:

• Install macOS 11.7.10 on a Mac Pro 2013, running macOS Big Sur 11.7.9
• Install macOS 12.7.2 on a Mac Pro 2013, running macOS Big Sur 11.7.10

For both tests I get the following result in Jamf Management...

[sdagley]

@janthenat For x86 Macs that old you can use erase-install (ignore the name, it can be used to upgrade Macs as well). See the wiki page for info on using from Jamf Pro: https://github.com/grahampugh/erase-install/wiki/6.-Use-in-Jamf-Pro

[janthenat]

@sdagley Yes indeed, and I'm already doing this. But, there is a new thing and I must play with it ;^)

[sdagley · Accepted solution]

WARNING! - PI116287 "Scheduled Software Updates (DDM) using Specific Versions Does Not Work" 

Apparently I was incredibly lucky that using a DDM Scheduled Update specifying version 14.2.1 actually worked because there is a bug in the current implementation that generates malformed DDM commands. Use the "Latest version based on device eligibility" or "Latest minor version" options to schedule an update instead.

This bug is present as of Jamf Pro 11.2.0, and reportedly will not be fixed until after Jamf Pro 11.3.0 is released.

[mrrobertbuss · Accepted solution]

Thank you for this. For me, this is the way to move forward on this issue. It may not be a solution for all. Resolving this ticket with this answer. 

[jender]

Have there been any updates on this? From Apple or Jamf? The solution above does not work for me. In fact, all combinations result in a 'AvailableOSUpdates - Scheduled Pending' status which eventually disappears but never actually notifies the user. 

[mrrobertbuss]

I have no further news to report. It appears to be hit or miss with no fault towards JAMF. This is on Apple. I just send out an email asking everyone to update their O/S when available, but, I have a small database of Mac users to deal with and it's easy to manage for me. IDK what larger Mac user companies are handling this. It would be great if Apple Business Manager would be able to handle the updates like they do with the apps. 

[jender · Accepted solution]

Thanks for the update. I was asked by Jamf support to open up a coop case but would need to go through AppleCare Professional Support, which we do not pay for. Anyway, that's not happening so I guess I'll be going back to the manual route. Frustrating!

[stephaniemm77]

Is still not working? I just tried to push updates and it is not working, wondering if its me or JAMF haha

[obi-k]

Did you try turning off the Software Beta Feature? Once you cancel all the in-flight plans, wait 15 minutes, then toggle it back on.

Try pushing the updates again.

When you check the logs, do you see "DeclarativeManagement" for a few devices you sent the updates to?

Also, don't select a specific version when updating (PI116287). Use "Latest version based on device eligibility." This PI is still in Jamf 11.5.

[dstranathan]

Is PI116287 only related to scheduled macOS updates? Is it safe to use DDM to push a command to install minor Sonoma updates ASAP and force restart?

I tested a few scheduled jobs on test Sonoma 14.4 Macs  (update to 14.5) and they never completed but those Mac still get the Notification Center notification from the past over and over. Very odd. And any new DDM commands I send to this test Macs don't seem to do anything at all.

Do I need to toggle the Jamf beta off/on to reset it? If so, is there any bad side effects to this? See screenshot from my JSS's warning below.

Will DDM commands get processed if the target Mac is asleep or if the the console user has locked the screen etc?

[obi-k]

This PI is still in 11.6. It's related to using a "specific version" when pushing out the update.

Some things I noticed:

• Macs will get the notifications repeatedly but don't restart and update on the exact date of the scheduled enforcement. Eventually though, they restart and update. Happens on laptops and desktops.

• If you sent out an old MDM command to your endpoints, any follow-up DDM commands/changes aren't used. The endpoints seem to respect your first commands; ignoring any new ones. The only way around this for me was to wait for a new update cycle.

• For example, if I sent out an old mass MDM command to update to 14.4.1 or 17.4.1, I could not send out a new DDM update command to these devices. It was ignored. I tried turning off Software Update Beta. When 14.5 and 17.5 dropped, I made a point to use the desired DDM command first and only. My success rate increased massively.

• From what I can see in testing, the Macs will honor your DDM commands once back online and checked in with Jamf. If you watch the logs, you can see that "DeclarativeManagement" is pending.

• I'm getting a little different story with iOS. If devices are powered off, some don't honor the DDM command and I have to send out another round. Just some slipping through the cracks.

PI116287

Using the "Download and schedule to install" command via the (Beta) Managed Software Updates feature to upgrade a mobile device to a specific version may fail.

[dstranathan]

Thanks. Looking for more clarification to understand this better. My isolated testing has been great when I set it to install to latest minor update and force a restart. Im nearly 100% successful. But when scheduling updates (regardless if I require a specific version or 'latest minor version'), the job gets ignored and I have no way to dismiss it, other than telling the user to manually perform the update as time allows. The user sees a notification from the past which is confusing to the user and not acceptable for production as it would create Help Desk calls, etc: "Is IT updating my Mac or am I? What is going on here?"

1 When you stated 'watch the logs, you can see that "DeclarativeManagement" is pending.' are you referring to the computer record's 'Management' tab in the JSS? Or are you referring to the macOS Console app on the target Mac?

2 'If you sent out an old MDM command to your endpoints, any follow-up DDM commands/changes aren't used. The endpoints seem to respect your first commands; ignoring any new ones.': Is this expected behavior or a known issue? Who is to blame here - Apple or Jamf?

3 If I attempt to toggle Software Update Beta off and back on again, I see JSS warnings (from my screenshot above in earlier post) is this normal? Can I safely toggle it without repercussions?

4 Can you comment on the expected behavior of how DDM works on Sonoma Mac targets that are asleep or locked? Will they process the commands, or will they wait until the Mac is unlocked? I can't find any details on this from Apple or Jamf.

5 Im planning on performing a DDM 14.5 update to my IT staff's Macs this Saturday night. Here is my exact planned workflow. Let me know if you think it will be successful:

Im sending the following DDM commands to ~20 M1 Sonoma 14.4 Macs to update to 14.5 and restart (forced): No schedule. No specific version required (Im using 'latest minor version' which currently is 14.5). It will be sent at 2AM manually by me, so most Macs will be asleep or locked obviously. In my isolated tested this worked pretty good, but they were not 'production' Macs. If this experiment fails, Im going back to Nudge for a few more months...

[obi-k]

• Good to know about the force restart and update. I'll consider that for some on my lagging lab Macs.

• Good point about the notification. We send out a communications email so our Mac users know. This works well for us.

1. Yes, in Jamf, but under the History tab. Then go to the Management History. Search for DeclarativeManagement. The good news is Jamf 11.6 should offer more DDM log information, so we'll know more about the state of the devices and commands we sent.

2. I'm not sure. This is what I've found in production and testing. If I recall, Jamf Support mentioned that there are some bugs that both are working out on some DDM details.

3. No repercussions on my end. I toggle back and forth often to clear the deck and start over. You should be fine. Just keep in mind it will retire commands that didn't go through.

4. Might be worth asking Jamf support. But it sounds like you're about to find out this weekend.

5. Let us know what happens...I think you'll get success, but curious what happens for Macs that are locked.

[dstranathan]

@obi-k  Thanks for the details, much appreciated. Ill keep you posted on my DDM testing over the next few days (and my 'big test' Saturday night to ~25 IT production Macs).

I just noticed that some of my test Macs reported AvailableOSUpdates - Scheduled, ScheduleOSUpdateScan, AvailableOSUpdates, ScheduleOSUpdate and OSUpdateStatus - Scheduled,  but did not report "DeclarativeManagement" in their Jamf  Management History logs.

Does this mean that DDM protocol wasn't used for the OS updates? These particular Macs are M1 Macs running Sonoma 14.4.x. and should be capable of DDM. My JSS is 11.5.1 (Cloud). Im confused here.

The success rate of all these Macs (when NOT using a schedule) is 100% - even on Macs that are asleep, idle, etc. I have tested ~10 Sonoma Macs (Intel and ARM) and the only Macs that have failed have been the jobs with scheduled commands. Any commands I have sent that are "Update to Latest minor version" + "Download Install and Restart" (forced) are working great thus far.

[obi-k]

I checked some of my Macs: I see similar results as you mentioned. Some have it, some don't. None of your Macs had "DeclarativeManagement" in it?

I'm guessing Jamf is using the old MDM command for the update and force restart then. Not DDM. Jamf would know.

Ok, nice. I might use this for some of mine. Keep us posted on your results.

[dstranathan]

Like you observed, some logs have DeclarativeManagement some do not.

[MPHEGGELO]

I am not seeing the success I would expect. I sent the update request with 3 deferments 6 days ago and I am still seeing users with the pending command in the device record...

[ccsshelpdesk]

I am also getting no joy on this also to any of our iPhones on ios 17x trying to upgrade using the schedule to ios 18 i am not using a specific version and it never works on any devices.

Will keep doing some testing and see if anything works.

[obi-k]

Are you running a newer version of Jamf? Also, have you tried turning off and ON the Software Update Feature? Your devices Supervised?

[MPHEGGELO]

Yes on all counts

[obi-k]

The other gotcha I had...

When I was having trouble with DDM, I reverted back to the old MDM update commands. 

Once the fleet got the old commands, I couldn't cancel them or send a new DDM. I had to wait until another iOS release and then used DDM.

What do your logs look like for a device that won't update?