I just uploaded it but I'm noticing that my JSS (8.73) and my dev JSS (9.32) are stripping the mcx settings. I'm going to test this out more, but it looks like Im going to have package this up with a postinstall script. I really wish Casper's profile options actually matched Profile Manager. It would make this so much easier.
I just updated my profile https://github.com/golbiga/Profiles/blob/master/blockosxbeta.mobileconfig and I tested against 8.73 and 9.32. This time there are no issues when pushed by my JSS. com.apple.SoftareUpdate in /Library/ManagedPreferences now shows AllowPreReleaseInstallation being set to false.
First off, thanks @golbiga for pointing out the Apple KB and method. And thanks to whomever at Apple that got this in place. Apparently someone there is looking out for us poor Mac admins!
That said, I noticed one thing to mention in testing. The Apple method seems to only work with the actual OS X Yosemite Beta, not against the 10.10.Developer Preview from earlier in the year. This makes sense I guess, but thought I'd mention it, just in case any user gets their hands on a Dev Preview installer. It would not work to stop them from installing that.
So, probably a good idea to take a double shotgun approach and keep the Casper Suite Restricted Software item in place for everything (or at least the Dev Preview) and also have this Config profile or MCX setting in place for the Public Beta version.
The process is still called "Install Assistant" so as long as that's in place, Casper will/should still catch it and shut it down before the Config Profile even needs to stop anything.
@boettchs True, a name change might be a workaround but I'm hoping between restricting the process name and with the mcx blocking the installation once the installer is launched that it should weed out most of the troublemakers.
If i block "InstallAssistant" as mentioned above, can it block other potentially 'legit' installers other than OS X installers, or is that really just part of the current OS X installers...
I suggest using "InstallAssistant" as the process to look for and block, not the app bundle name. This is discussed earlier up the thread on why so I won't repeat it again in this post.
Edit: @kstrick - I haven't seen "InstallAssistant" used anywhere else, but I can't say 100% that it couldn't block other legit installers. Personally I'd rather use that and if someone reports that another installation is getting blocked as well, we can adjust it later.
I can confirm that the profile works. Upon launching the installer, when you go to choose which disk you want to install Yosemite on, a pop-up will show up saying, "The prerelease version of OS X Yosemite cannot be installed on this Mac due to the Software Update Policy in effect."
Having a strange issue where the Mac is reporting 'MDM Capability' as 'No'. Not sure if that's just a weird issue that only this one that i'm testing Yosemite is having.
Edit: Just wiped it and loaded an unbooted 10.10 image(via AutoDMG) and reenrolled into JAMF. The JSS MDM Profile loads fine and shows as Verified in Profile Settings on the Mac, but i still get a MDM Capability: No in JAMF. I also can't select this machine when scoping out a config profile(as expected i guess).
Pretty sure it only shows as MDM Capable: No, is because it is beta and therefore unsupported in a production environment.
My machine which I am running Yosemite on reports MDM Capable: No, also.
Once Yosemite is officially released and JAMF release the version of the JSS to support it, it should be fine.
I would say that until JAMF releases a 9.x version of Casper that supports Yosemite, you're likely to see all kinds of odd issues when testing it in the JSS. I wouldn't be too concerned about any of those just yet. JAMF always waits until the official release from Apple before they unveil their own updated product.
I would not count on that. I know they did it for Mavericks because 9.x had just been released and they knew a lot of customers were still on the 8 series, but I wouldn't hold my breath for any 8.x patch to support 10.10. Development is focused on the 9 series I'm being told.
We're also still on 8.73 here, but we're planning our move to Casper Suite 9 for late summer because, well, the handwriting is on the wall there. Anyway, 9.x has matured a bit and doesn't have nearly the amount of issues it had when it was first released. Time to make the move methinks.
TAM just emailed me about that actually. JAMF is not planning a code patch for 8.x. Extremely disappointing since 9 hasn't even been out a year yet. This AFTER we just finished talking about how to move my MCXs to Config profiles easily (where are the actual plists I have are located on the JSS, so I can grab them and run them through MCXtoProfile), how I'm not able to grab them in the JSS on v8.x, and MCXs won't move over in the upgrade from 8.73 to 9.x (in testing this has always held partially true).
I can't plan any move to 9.x until we figure out our server sitch (stuck on 10.6.8 servers ATM and windows VMs are sort of out of the picture because of other dependencies). *VERY frustrating*.
Sorry to hijack, folks.
@acdesigntech: you're disappointed, which is fine, but at the same time you are running on 10.6.8 servers? Not sure that your infrastructure being so far behind matches the need to run Yosemite Macs. You can't expect them to keep adding new OS support to an old version of the JSS software - IMHO.
Seems like getting your server sitch settled first is a good idea...
10.10 is available today. Here's what I have for blocking Yosemite installs in Casper (Restricted Software):
- Block process name: Install OS X 10.10 Developer Preview
- Block process name: InstallAssistant
Can anybody verify that these will work to block the installation of Yosemite? And is there a more specific string I can use other than InstallAssistant, in the interest of only blocking Yosemite installs and not anything else?
The Apple website has this as the link to the App Store for Yosemite:
Nothing there yet but I bet if enough people click the link it will magically go somewhere.