Pushing 10.12.2 Combo Updater to logged off Mac, but it is not restarting

[donmontalvo]

Is there a secret sauce for getting the 10.12.2 Combo Updater to run and reboot when pushed to a computer that is at the login screen?

We have the Restart Options set to:

We have the package Options set to Requires Restart:

What we are seeing, is the 10.12.2 Combo Updater is running, but the computer never reboots. When the user logs in, the computer says it is at 10.12.2. But not comfortable with that. It really needs to be rebooted after the 10.12.2 Combo Updater is applied.

Incidentally, we are SSH'd onto the Mac, which Jamf Support said doesn't count as a user being logged in. The Linux part of me thinks it would, but I digress. :)

Is anyone seeing this issue? How are you getting around it?

JSS 9.92 which we know doesn't support Sierra, but unfortunately are unable to move to 9.97 until weeks after it's release.

[Look]

Make sure there actually are no users logged in, you can be on the login window and still have users logged in...
Also I have always found Caspers restart functions unrelaible and resorted to scripting a forced restart ages ago.

[donmontalvo]

@Look thanks, this is on LAB computers, we disable Fast User Switching. I was thinking my being SSH'd into the Mac counted as, well, logged in. Will test again, without SSH'ing in, and will update this thread.

[Look]

Yeah like I said, I have found the Casper restarts to be too cautious and therefore unreliable for OS updates etc... I usually just follow them up with some variation on:

shutdown -r now

in a script.

[donmontalvo]

Totally forgot to circle back to respond. We decided to force a reboot as suggested, and its working.

But as expected, (1) JSS has no idea the policy completed since jamf client didn't report back success, and (2) Self Service comes up still showing macOS Sierra upgrade, because recon didn't run and as far as it knows you're still in scope.

We're trying a few other things, if we end up with the magic sauce, we'll share.

[dpertschi]

You need to trigger a recon at next login. The OS update isn’t registered on the system until reboot.

[claven]

We have made some changes to our update deployment strategy with great results.

1. Setup a Launch Daemon that does a recon followed by policy on every startup. This keeps reoccurring items from running when not needed if Jamf Pro doesn't know that a policy finished or if updates/applications/maintenance were previously installed.

2. Smart Group to detect what updates are needed from our internal SUS at the daily inventory cycle

3. Policy once a day or week that installs updates without a reboot to the SG members, then calls mm2270's awesome reboot scheduler after the SUS finishes to let the user choose a delay up to 8 hours in the future.