I'm starting this thread because I'm not happy with the app patch management situation for my company.
Would love to read any recommendations or other input to learn how to do it. (I don't know if I'm the only person who has this problem but many users avoid updates, upgrades, or restarts - macOS is running all the time.)
Just my thoughts about this topic:
In case u handle it via Jamf AppInstaller... if I add for example Google Chrome the application will be updated after the user has manually closed the application. So, in the worst-case situation, the user will not close Google Chrome or other applications because of any reason. To sum up, the application is not updated and if the application has high-risk backdoors I can do what? ->
If I do it via Jamf Patch Management I don't know when the force trigger will pop up for the user. Currently, I'm trying to do it and counting the days to do the force update at the weekend but of course, the user could log in to his machine on Monday but actually, the update will not update prompt ASAP. In this situation, it could happen for example if the user has a meeting.
A solution for it would be to set-up also a time when Jamf Pro can force it (General lunchtime, before 8 am, after 7 pm)
I am also not very happy with how it works after testing it out today. I was hoping for at least a list on what Macs in the Smart Group has it successfully installed. It is still in preview so I hope that more functions will come soon!
For the moment I would recommend you to use the project Installomator instead.
GitHub - Installomator/Installomator: Installation script to deploy standard software on Macs
It can be configured almost as you desire and has more apps that can be deployed.
+1 to Installomator. It really is spectacular at deploying software, and in conjunction with self-service, it's great for updating as well.
As far as patch management goes - when it is an essential update I like to send a notice to the community giving them X amount of time (x being dependent on how critical of an update it is) to update.
I Agree with what @KretZoR said Installomator is the a great tool to automate the deployment and patching. You can read this article by Armin Briegel on scriptingosx.com (he's one of the developer of Installomator)
Another tool you can take a look at is PatchBot a bit more complicated than Installomator
For notification just make sure the Display Notifications" is checked and the "Self Service and Notification Center" is selected. You can also look at Yo for notification.
New to Jamf here, just starting the setup and testing phase. One of the concerns is getting software updated. I did come across the article by Armin. Do you just go through that process with creating 2 smart groups and and a policy for each application? We're not to concerned about deferring updates. Thanks in advance
yes, u have to create two smart groups because if u do it without the "member of" smart group u will get an error "Policy scope cannot be based on a smart computer group that uses the "latest version" criteria."
Since I started with this topic I already configured a few policies with Installmator and I'm very happy with this process because of different deployment ways like silent/success with notification or without notification. Because we working with Google Workspace I decided to handle Chrome a little bit differently for patch management. So, I added a token between Jamf & Google Workspace to handle Plist attributes and another launch agent to trigger the update process.