Office 365 VPP install

[Wakko]

During our testing, we noticed the following. Excel installed via Self Service without an issue. However when we tested Word and PowerPoint as a push. It installed successfully and then created a "stub" record as well for both of these applications. I let it sit for a while to see if it would self-correct, but it has not. I ran Recon in hopes that it would delete this stub entry, same results as pervious. Lastly, I rebooted the machine and upon login, they were still there. I'm able to launch the applications without an issue. If we launch any of the stub records it launches the AppStore and gives us an error. The AppStore opens and it quickly shows "No Purchase" before it loads the AppStore. Has anyone come across this yet?

[nahrens]

Isn't the MAS version only available for Office 365 users? I was under the impression that it could not be license activated.

[pbowden]

@nahrens correct - with the MAS version, you can either activate an existing Office 365 subscription (consumer, commercial, edu) or use in-app purchase to buy a new consumer subscription

[metalfoot77]

@pbowden I have everything in place and when I open a MAS app now it immediately just prompts for a sign-in. This is expected behavior or is there a way to activate in a manner that allows our students to use the MAS Office apps without a login?

[pbowden]

@kricotta Students will still need to sign-in to O365 to activate the license, even with MAS builds. Depending on your set up, you might be able to make this a little easier for them by pre-filling their email address/UPN through the 'OfficeActivationEmailAddress' preference, but either way, they'll still need to enter their password.

[jameson]

@pbowden

You are the wizard of office, so maybe you can help:). Do you know both in the new VPP and old setup what triggers when updates have been installed, but an restart of the application is needed ?. I just need to figure out in which file this happens, so I can see users who have updates installed, but awaiting an restart of the application

[pbowden]

@jameson not as old as Gandalf though (yet!). Can you elaborate a bit more on your question or give me a scenario?

[pbowden]

@jameson I just re-read your question a couple of times. It seems like you're trying (wanting?) to install app updates without closing them. Right now, this isn't possible with MAU or MAS. If you forcibly apply the update without closing the app, it'll more than likely crash a few minutes later, as the in-memory process will try to read a resource from disk, which will have changed, which will cause the app to fault.

Suffice to say, we are actively working on an improvement to MAU where it will clone the active app, update the clone, then swap paths on next app launch. We're still a couple of months away from releasing this. The engineering work has been done, but we need to do significant testing of all scenarios before we release it.

Hope this helps!

Paul.

[Flaurian]

Just for information, I had the keychain error also for clean macOS devices with the first installation of Office via VPP. I fixed it now with policy via Self-Service and your posted script. Thanks again but I still if the issue with downloading the apps from the VPP store. Sometimes the user has to the process via Sefl-Service three times.

[jameson]

@pbowden It sounds good the new solution for Mau. However, right now it is not what I am looking for. When updates have been applied users get an small notification sliding in the app needs to be restartet to update, but most users just ignore this.

So If I could make an extension attribute, so I can see which clients have restart pending for application. But to make such an extension attribute, I need to know which file(s) I should look at, that shows that an app restart is pending

Hope it make sense

[jr139]

@Flaurian we are seeing this behavior in Self Service too, sometimes office apps will install on the first attempt via Self Service. Other times it takes three or four attempts before it will install.

[pbowden]

@jameson ahh, thanks for the info - I understand your question now. Basically, your EA pseudo-logic would look like this:

MAUPID = (pgrep 'Microsoft AutoUpdate Assistant') // get the process id of MAU's daemon if [ $MAUPID ]; then // only do the following if MAU's daemon was running PKG = (ls $TMPDIR/MSau_$MAUPID) // get a list of the package filenames that MAU has pending fi echo "<result>$PKG</result>"

That's the basic logic you'd use when running at the console. You'll need to do some investigation to figure out the best way of running this in the context of the current user, especially as $TMPDIR is a user-based environment variable.

Hope this helps get you started!

Paul.

[landon_Starr]

Sorry if this has been asked in this or other threads, but do we know why the O365 apps are creating duplicate icons upon VPP install?

I've seen behavior vary from the duplicates disappearing once the install completes, to a user having 2 sets of icons permanently.

[ThijsX]

@landon_Starr It is mentioned here multiple times, sometimes stubb files get created.

Check this Mac App Store MacAdmins page for more information. search on the term "stubs" and find your answer.

[landon_Starr]

Dope. Thanks again, @txhaflaire !

[metalfoot77]

@pbowden ok thanks for the clarification. At this point I think it just makes more sense for us to continue using the MAU and the packaged versions of Office for our labs. I don't want to require students to have to log into anything when using Office. Thanks for your help!

[dswitmer]

I have the problem with the incomplete apps. As I read it, the only fix is to keep trying. That seems like a show stopper for this delivery method. Am i overlooking anything?

[danreedphoto]

I have 4 Macs set up in my lab. Both 10.12.6 Macs that have the VPP Office Apps scoped to them work every time. All 10.14 Macs fail 90% of the time and end up with the 146kb stub installers. If I run recon on the 10.14 Macs, the stub installers re-download every time.

[JamfMyMac]

@pbowden

I checked out :https://macadmins.software/mas/. I used VPP to deploy 0365, not sure why but I don't see the 0365 get automatically updated. What would be a way to push for the updates? I just want to make sure VPP will auto update these apps..

[ThijsX]

@aaelic24 i see similar behaviour on our pilot group with MAS apps installed, only OneNote is up to date.

Other VPP apps do get automatically updated, like Microsoft RMD, Slack etc.

We have an forced check for updates configured everyday.

[JamfMyMac]

@txhaflaire

What do you mean forced check for updates? How are you accomplishing that?
I am doing it also.. but I don't see my apps get the updates.

[pbowden]

@dswitmer @danreedphoto If you're seeing the stubs issue on Mojave, take a peek at the Console app, and look under System Reports to see if 'storedownloadd' is crashing at the time of app install. I've added the RADAR # for this to https://macadmins.software/mas

@txhaflaire When your other VPP apps are automatically updated, what does the user see if the app is in a launched state? Do they get a notification to close the app? @aaelic24 for the issue where you're not seeing updates, check in Finder to see if the updates are stuck. There's a screenshot at https://macadmins.software/mas and also the Jamf case ID and RADAR that we're tracking for this issue.

[ThijsX]

@aaelic24 I mean that we have set to check every XX:XX for Mac App Store updates and force them via Settings -> Computer Management - App Updates:

@pbowden Users with app in launch state are not receiving any slipstream prompt oi. But now u clicked the button to force update on App Updates section my apps are being updated. Maybe it is because i have set the update time on 12:00 PM, so i have now set that to 01:00 PM and that is a moment when most clients are active and online, so will see how that works out.

Okay, nothing good happened, the icons appeared as they get updated but bad results, all apps are closed before pushin updates.

Thread 5 Crashed: 0 libxpc.dylib 0x00007fff6e137b94 _xpc_api_misuse 75 1 libxpc.dylib 0x00007fff6e123ff1 xpc_connection_send_message 132 2 com.apple.StoreFoundation 0x00007fff67c7d99f -[CKDockMessaging sendInitialMessageForDownload:] 442 3 storedownloadd 0x0000000101ba41f6 0x101b7e000 156150 4 storedownloadd 0x0000000101ba2e1e 0x101b7e000 151070 5 storedownloadd 0x0000000101b9238a 0x101b7e000 82826 6 storedownloadd 0x0000000101bcbd41 0x101b7e000 318785 7 com.apple.StoreFoundation 0x00007fff67c82f93 -[ISOperation sendProgressToDelegate] 184 8 com.apple.StoreFoundation 0x00007fff67c6028c -[ISURLOperation _updateProgress] 207 9 com.apple.Foundation 0x00007fff4304f105 NSFireDelayedPerform 433 10 com.apple.CoreFoundation 0x00007fff40cbedfd __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION 20 11 com.apple.CoreFoundation 0x00007fff40cbe9b0 CFRunLoopDoTimer 859 12 com.apple.CoreFoundation 0x00007fff40cbe4f0 __CFRunLoopDoTimers 333 13 com.apple.CoreFoundation 0x00007fff40c9f737 __CFRunLoopRun 2176 14 com.apple.CoreFoundation 0x00007fff40c9ec64 CFRunLoopRunSpecific 463 15 com.apple.StoreFoundation 0x00007fff67c5e837 -[ISOperation runRunLoopUntilStopped] 46 16 com.apple.StoreFoundation 0x00007fff67c5c559 -[ISURLOperation _runWithURL:] 862 17 com.apple.StoreFoundation 0x00007fff67c5c125 -[ISURLOperation _run] 254 18 com.apple.StoreFoundation 0x00007fff67c5bd3e -[ISURLOperation run] 238 19 com.apple.StoreFoundation 0x00007fff67c63da4 -[ISStoreURLOperation _runURLOperation] 2648 20 com.apple.StoreFoundation 0x00007fff67c632a0 -[ISStoreURLOperation run] 368 21 com.apple.StoreFoundation 0x00007fff67c5b52a -[ISOperation _main:] 418 22 com.apple.StoreFoundation 0x00007fff67c5a95b -[ISOperation main] 540 23 com.apple.StoreFoundation 0x00007fff67c5a331 -[ISOperation runSubOperation:returningError:] 209 24 storedownloadd 0x0000000101bcf2a4 0x101b7e000 332452 25 storedownloadd 0x0000000101bcb2a5 0x101b7e000 316069 26 com.apple.StoreFoundation 0x00007fff67c5b52a -[ISOperation _main:] 418 27 com.apple.StoreFoundation 0x00007fff67c5a95b -[ISOperation main] 540 28 com.apple.StoreFoundation 0x00007fff67c5a331 -[ISOperation runSubOperation:returningError:] 209 29 storedownloadd 0x0000000101b8ef83 0x101b7e000 69507 30 com.apple.StoreFoundation 0x00007fff67c5b52a -[ISOperation _main:] 418 31 com.apple.StoreFoundation 0x00007fff67c5a95b -[ISOperation main] 540 32 com.apple.Foundation 0x00007fff42ffb104 __NSThread__start 1218 33 libsystem_pthread.dylib 0x00007fff6e0e4305 _pthread_body 126 34 libsystem_pthread.dylib 0x00007fff6e0e726f _pthread_start 70 35 libsystem_pthread.dylib 0x00007fff6e0e3415 thread_start 13

[pbowden]

@txhaflaire can you post the full call stack from that crash instead of just the crashing thread? If you don’t want to post it publicly feel free to email it to me pbowden at microsoft dot com.

[ThijsX]

@pbowden Sure! emailed the file to your mailbox!

[pbowden]

@txhaflaire thanks - I received your email, and just replied to it. To confirm for everyone else out there, you're running into RADAR 47685116 where the storedownloadd process crashes during app install from MAS. The tell-tale sign in the crash log is this...

Exception Type:        EXC_BAD_INSTRUCTION (SIGILL)
Exception Codes:       0x0000000000000001, 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Illegal instruction: 4
Termination Reason:    Namespace SIGNAL, Code 0x4
Terminating Process:   exc handler [4697]

Application Specific Information:
dyld3 mode
API MISUSE: Resurrection of an object

[jameson]

@pbowden

I just tried to setup the following based on your input. Are you sure it is the Microsoft Autoupdate Assitant that should be prep´et ? - and not Mirosoft Autoupdate ? -

But want to ask you are little about the PKG = (ls $TMPDIR/MSau_$MAUPID)

Can you explain a little on this ?. $tmpdir is a variable as I know through my basic scripting experience ? but cannot understand how the process microsoft autoupdate ID it is possible to see which applications awaiting restart to be updated

Could an another option be, that if knowing where autoupdate is downloading the updates and it somehow sets a "flag" in a file that a restart is pending, make a smart group based on if this flag or updates exist. I suppose after restart the software updates are removed so they fall out of the smart group again

[JamfMyMac]

I am still having issues setting up the Nuke Keychain script. I followed all the steps and no luck.

[jpoirson]

same issue here with the incomplete downloads... reply from jamf :

Hello ,

Thank you for sending those.

Looks like we are facing 3rd party issue and we have open AppleCare ticket for that behaviour.

PI-006725 Large Mac App Store Apps not installing, leaving .appdownload file in place

This is happening often with Office 365 packages and Xcode.

https://www.jamf.com/jamf-nation/discussions/30848/office-365-vpp-install

Currently the workaround will be to install from App Store directly or clear out the .appdownload and try again to install.

Best regards,

[chrisleduc]

We have the issue with iLife/iWork Apps which we delete so that they can be properly managed via VPP. Because they're large, they tend to stall a lot at the moment.

We look for computers that do not have all the apps that they should and we run this command to delete any .appdownload files that are older than 45 minutes (in our case, we found this to be ideal).

sudo find /Applications/*.appdownload -ctime +45m -print0 | xargs -0 sudo rm -rf ; sudo jamf recon

This nukes any stalled downloads and the recon allows jamf to re-push those via VPP once more.

Definitely not a nice solution in terms of network traffic and it feels stupid to have to keep deleting the same files over and over again… but it works.

[Cayde-6]

How are you guys checking to ensure the Office Apps have been closed before starting this method to remove the apps?

[pbowden]

@Echevarria @txhaflaire @hkabik @Flaurian @jr139 @landon_Starr @dswitmer @jpoirson @chrisleduc @danreedphoto
The issue with storedownloadd crashing during MAS installs is fixed in 10.14.4 Beta 4 (18E205e). This is RADAR 47685116. Let me know if you still see problems after the update. For clarity, typical symptoms of this bug:
- Larger MAS apps like Xcode and Office fail to install and leave behind an .appdownload stub
- Needing to run multiple jamf recon commands to coerce apps to install
- MDMClientError:72 failed command seen in JSS

I've updated https://macadmins.software/mas with the latest info. The largest outstanding issue that I'm still tracking is the inability to update MAS apps through MDM when the user has the app perpetually open.

[danreedphoto]

@pbowden Thank you for the update! Great news!

[jr139]

@pbowden Thanks for the update!

[Cayde-6]

Does anybody else suffer with having to re-setup OneDrive from scratch?

When the CDN version is removed and the VPP installed I have to setup OneDrive all over again

[ThijsX]

@pbowden Thanks for the update !!

[Wakko]

@pbowden Thanks for the update. Took some R&R and just catching up. Will fire up a machine, test, and report back.

[BB_jamf]

Forgive me if this has already been addressed, has anyone addressed the issue with reverting to a prior version? Eample: We recently discovered that the latest Webex utility breaks when Outlook is updated to 16.23. How would one go about reverting to 16.22?

[pbowden]

@BB_jamf its a good question. No way to do this through the Mac App Store. To revert to 16.22 you would need to download from https://macadmins.software.

Thanks, Paul.

[rstasel]

So, just found this thread because we're running into something odd trying to move from CDN to VPP MAS.

We have a policy that runs that nukes office, unlicenses and nukes the keychain (the latter being pbowden scripts). Then runs a recon that throws the computer into a "MAS Install" smart group and a VPP MAS install (push) scope. This then starts the Office MAS installs. Those SEEM to run successfully, BUT, they then seem to start running again! And then THOSE stubs get left behind/stall. Oddly triggering the VPP MAS installs of office also seems to trigger other VPP MAS installs as well (like on my machine iWork reinstalled, as did Microsoft Remote Desktop).

The first installed versions work fine. This is on a 10.14.4 machine.

Anyone else seen this odd behavior?

[LovelessinSEA]

@rstasel How did you get the nuke keychain script setup? I can't seem to figure out how to get it to do anything. I've set the parameters in the script and then called those in the policy but I'm positive I'm doing something wrong.