Microsoft Autoupdate Script and 10.14 Mojave

scottlep
Contributor II

We are doing some testing with 10.14. When our policy to update Office 2016 via the msupdate script runs we receive the following prompt (see screen shot) “jamf“ wants access to control “Microsoft AutoUpdate“. Allowing control will provide access to documents and data in “Microsoft AutoUpdate“, and to perform actions within that app. I clicked OK to allow the process to run. The policy is showing as complete with no errors, but the apps were not updated and I got different output in the logs compared to computers running 10.12-10.13 where no updates were applied even though there are updates available (see other screen shot). I just flushed the policy log to see what happens next time it tries to run.

I just run through System Preferences to see if "jamf" was added to the Security & Privacy>Privacy pane to see if it was given access to Accessibility, Automation, etc....but I don't see it added anywhere.

Any ideas how to avoid this prompt or is it something we will need to live with with the new security in 10.14?
07614b4a5db249aa85aa204ff9f621b4
ebff529a468a4921882a415a270bf59b

21 REPLIES 21

sdagley
Esteemed Contributor II

@scottlep What version of Jamf Pro are you running? 10.7.1 should have the required tcc profile to give the jamf binaries file system access without that prompt.

scottlep
Contributor II

@sdagley The JSS and the client are running v10.7.1-t1536934276. This is our dev JSS and a test machine.

Thanks!

koalatee
Contributor II

10.7.1 profile does not give the jamf binary access to Microsoft Outlook. You should use the PPPC utility to build a profile for jamf to control Microsoft AutoUpdate

PPPC Util

anverhousseini
Contributor II

Do I have to add /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/msupdate to the whitelist for that? Seems still happening with Jamf Pro 10.9.0 and the checkbox enabled under Computer Management > Security.

CypherCookie
Contributor

I don't know anyone who uses scripts to set auto-updates for office any more. We now do it via a custom config profile. Have you tried doing it this way?

burdett
Contributor II

I'm been having the same issue when using @pbowden's Jamf Pro helper script for controlling Office and Skype updates
Any one have success using the PPPC utility to build a profile for jamf to control Microsoft AutoUpdate? Still trying to figure out how to build profiles with this utility. I saw a discussion this recently with screen shots of the PPPC utility building a profile for jamf to control Microsoft AutoUpdate but now I can't find it.

pbowden
Contributor III

@burdett you can pick up both the signed and unsigned mobileconfig for Jamf to control MSUpdate on my GitHub at https://github.com/pbowden-msft/MobileConfigs/tree/master/Jamf-MSUpdate

Hope this helps!

Paul.

CypherCookie
Contributor

Office is now available in the Mac App Store!

sdagley
Esteemed Contributor II

While Office in the Mac App Store is useful for some, I see it as a non-starter in organizations that require testing prior to mass deployment and use msupdate to restrict updates to approved versions. (I don't know of a similar capability for App Store delivered apps)

jbellez
New Contributor III

I am trying to figure out the mobileconfig, as I think this is what is having an issue.

I'm also seeing the "No result returned from Update Assistant" error, but it is only on mojave machines.

Any idea why this error only appears when running through a Jamf policy?

Running the script alone (even a DIY one I made with 2 commands) will return the same error through Jamf, but is fine when running it through terminal myself as the logged in user.

pbowden
Contributor III

@jbellez sounds like you haven’t applied the PPPC config to that machine. It allows the Jamf agent to send Apple Events to MAU
Deploy the profile from Here

jbellez
New Contributor III

EDIT: Still doesn't work even on a clean machine :( I even tried to install the mobileconfig directly, but it doesn't like it.

@pbowden Just to be sure, this is to be deployed as a config profile correct?

I have tried both files (one at a time of course), but it doesn't seem like it did anything. It still doesn't seem to update my apps, with your script or my own that just calls the msupdate command to trigger all updates.

5ba471a9b5914a6bafca7afb902addb9

Here's the log:
81b344bb6586464c84a2011f81ca01f1

pbowden
Contributor III

@jbellez what version of MAU is installed on the machine? It needs to be 4.12

jbellez
New Contributor III

@pbowden it's 4.12. I have a Jamf patch policy that kicks in for machines that don't have the current version. I check the MAU app info for when the version changes manually (I'm purposely starting with the default one used when we deploy our systems 4.2, so we can get the full effect of the upgrade process when we go production with this).

Jamf status always completes quickly and shows that error "No result returned from Update Assistant" for each app, minus the ones not installed.

My quick and dirty script tries to rule out anything funky:

# Word
if [[ ! -e "/Applications/Microsoft Word.app" ]]; then
    echo "Word is not installed"
else
    /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/msupdate -i -a MSWD2019
fi

but also returns the same message. I'm kind of stumped at this point... I feel like it's the PPPC stuff, as the symptoms would indicate so.. I'm just thinking maybe Jamf is missing some permissions to execute.

leegalan
New Contributor III

@jbellez are you still having this issue? If not, how did you resolve it? I'm in the same situation as you.

jon_verret
New Contributor III

@pbowden is this thread dead? I'm having the same issue and can't find a solution. I've uploaded the PPPC config profile, but that didn't result in any changes to the script results..

ysdevgan
Contributor

@pbowden , all machines running 10.13 or above getting error: ERROR: Cannot send Apple Events to MAU. Check privacy settings

Am using latest PPPC config profile and script from github (https://github.com/pbowden-msft).

timdsmith72
New Contributor III

I have the same issue. Been beating my head against the wall for days.

ysdevgan
Contributor

I have tried removing (might be good practice or recommendation) CheckAppleEvents function (from line 46 to 52) and also removing CheckAppleEvents (line 115) from script that Paul has shared on GitHub. Here is the logs from a couple of MacBooks :-

Script result: Started - Thu Feb 13 12:23:04 PST 2020
User xxxxxx is logged in
Thu Feb 13 14:23:10 PST 2020
Detecting and downloading updates...
Daemon is busy...
[message repeats 1589 times]
Daemon is busy./Library/Application Support/JAMF/tmp/Microsoft Office Suite Update -WKS testing: line 97: 74464 Terminated: 15 ${CMD_PREFIX}/Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/msupdate --install --apps $1 --wait 600 2> /dev/null
Finished - Thu Feb 13 19:09:55 PST 2020

Script result: Started - Thu Feb 13 15:22:02 EST 2020
User xxxxxx is logged in
Thu Feb 13 17:39:03 EST 2020
Detecting and downloading updates...
Daemon is busy...
[message repeats 23 times]
No result returned from Update Assistant
Finished - Fri Feb 14 04:27:38 EST 2020

FYI, I have scoped the policy to smart group which has devices running an older version of MS word.

I would appreciate if someone can help or share their experience updating MS office apps via JAMF.

timdsmith72
New Contributor III

So, for anybody still fighting this:
This worked for me. https://www.jamf.com/jamf-nation/discussions/34787/microsoft-office-for-mac-2019-autoupdate-jamf-trigger

AutoUpdate Fix

ysdevgan
Contributor

Thanks @timdsmith72 , will test it out.