Have you tried forcing an MDM command to cause the update? After a conversation with Apple I started using the MDM command for all our workstations running Monterey and higher. It's been mostly successful. The only time it seems to not always work is when the workstation has not rebooted for a few weeks. Given the output of this will be uncontrolled reboots to apply the patch, I definitely go through our change approval process to get proper approval to force reboot mid-day. I've had more mixed results doing the first 2 options (download for the user to install/download and prompt to install after X deferrals).
So i have some nice "Nudge" style policy i created using Jamf Helper, its not as fancy as nudge but gets the job done fore end users when they are logged in. We pop it up give them an option to defer or do it right then and there. Had best luck with that.
We dont want to do an erase install just in place upgrades. And its different when a user is logged in vs a lab machine with no user.
The issue im having with both Jamf and Apple is the inconsistency in commands and answers i get depends on the tech im talking with. Apple is horribly my engineer gives me different answer a few weeks apart when the first answer didnt line up with what i found.
I have been using this command
sudo softwareupdate -iaR
to keep the OS up to date. I asked Appel and Jamf will this command upgrade a 12.6.2 or 12.6.3 machine to Ventura, at first both said no. I have a set of like 32 machines at 12.6.2 and 12.6.3 that are slowly upgrading to 13.2 or 13.2.1 i run that command every friday night, and over the past 3 weeks i have seen 26 out of 32 machines upgrade themselves, but i pushed this command out to about 300 and the rest are staying put.
Running the command manually in terminal is also hit or miss ive seen it upgrade and other times not upgrade.
Look at the screenshot do you see anything wrong with it? At first both apple and Jamf said that the command will not upgrade to Ventura. But as you can see it is. And the OS is 12.6.3 so either the bug is still not fixed or Apple has no clue what its commands do. But also i ran that same command on an identical machine, same hardware and OS (lab machines built identically) and the command doesn't upgrade to Ventura.
Not sure where folks are on this but I thought I'd share one thing that's helped my environment. Usually when CVEs are identified and a specific patch requires deployment, I've gotten a lot of traction from my user base just by educating them with a Jamf helper pop-up.
#!/bin/bash
# Update Notification.sh
#
#
# Created by Corfman, Ed on 11/22/22.
# Edited to correct the date variable (line 11).
#
# Get Version of macOS
date=$4
version=$(sw_vers -productVersion)
getversion=$(
if [[ $version == 13.* ]]; then
echo "macOS Ventura"
fi
if [[ $version == 12.* ]]; then
echo "macOS Monterey"
fi
if [[ $version == 11.* ]]; then
echo "macOS Big Sur"
fi
if [[ $version == 10.* ]]; then
echo "macOS Catalina"
fi
)
/Library/Application\ Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper -windowType hud -lockHUD -title "Your Company Workstation Software Update Needed" -alignDescription justified -description "Your computer requires an update to the Operating System - $getversion.
Please update your workstation at your earliest convenience to prevent an unplanned forced restart. Forced updates are scheduled to begin $4.
Thank you for your prompt attention and cooperation in keeping Our Company workstations safe and functioning efficiently!" -icon "/Applications/Utilities/Path/To/icon.png" -button1 "I Understand" -timeout 900 -countdown
exit 0And I give the
date=$4as a specific date within my policy. After that they can expect to be rebooted whenever after that date.
Once that runs as a policy daily to any target not on latest macOS release they get a nice popup encouraging updates.
