“Reinstall a Clean macOS with One Button” webinar resource page

@mhegge, finally getting caught up with posts. Glad you got something working for you.

I noted a couple of things from your earlier posts:

1. Each version of startosinstall (Catalina, Mojave, High Sierra, etc.) has a lot in common but also some things not in common. Some options like --forcequitapps aren't available in every installer app. You'll need to run startosinstall --usage for the supported list of options for that app version.

2. The softwareupdate command with the options --fetch-full-installer and --full-installer-version are only available to macOS Catalina. You can't use those options with Mojave or earlier. However, you can run them on Catalina to download earlier versions of installers like Mojave and High Sierra.

And I wouldn't be surprised some folks are using community-created scripts to download installer apps from Apple. If so, I've found there's usually no need to run sudo to run those scripts. That runs them as root, which isn't necessary because the script isn't modifying a location that requires elevated privileges. The app installer also seems to need permissions changes too if run with sudo.

Hope this helps folks going forward.

FYI, if you set your 8GB OS to cache ONGOING you are going to have serious problems with your network. Change that to once per machine or use a caching server. Our whole network went down, we later found out that it was the OS caching "Ongoing". Something like this could get your fired.

@jsuarez, in the setup I outlined "Ongoing" doesn't mean "download over and over". It means "ongoing for those Macs in scope". If you're deploying the installer and immediately taking inventory, then those Macs should fall out of scope for the policy and cease downloading the installer.

The advantage of "Ongoing" is that Jamf Pro will be able to redeploy the installer app should someone remove it from the computer.

Yea, Ongoing is only an issue if you are scoping it to all of your machines instead of a smart group of computers that don't have the installer cached.

@talkingmoose hope this is easy... Fairly new to Jamf but would really love having this functionality. I copied the instructions and macOS Catalina is caching the installer properly on the macs but when I press the one touch button in self service it displays the following in the log:

@rhowell, your command on line 5 looks perfectly correct. The result you're receiving indicates you are actually calling the command but it thinks at least one of your arguments is wrong.

They look fine to me. Usually when I see this, one of the sets of double-dashes isn't really double-dashes but instead similar looking characters (e.g. non-breaking dashes or short hyphens). This happens oftentimes when copying pasting the entire command from a webpage. Try retyping each set of dashes. Make sure there are no spaces between the dashes and the following word.

@talkingmoose That seems to have taken care of it perfectly! Thanks for the reply

Thanks @talkingmoose ! Retyping the dashes worked perfectly!

Hello all. Been using JAMF for about 2 years, but new to the forum. I have had this working well for a number of months; however, recently the command '/usr/sbin/softwareupdate --download --fetch-full-installer' is not not only downloading the Catalina installer but also running it. I have tested this in terminal as root and see the same results. Anyone else have this happen or have any input on how to prevent the installer from starting?

@highlandtel, with the --fetch-full-installer option, you don't need to include --download. I suspect if you remove that the installer will stop launching.

Any suggestions for handling this complication as reported in the policy log?

Result of command: Error: Erase installs are supported only on APFS disks. By using the agreetolicense option, you are agreeing that you have run this tool with the license only option and have read and agreed to the terms. If you do not agree, press CTRL-C and cancel this process immediately.

Our systems are currently running 10.13.6 (HFS+) and I'm wanting to do a clean install of 10.15.x

Hey talkingmoose, thanks for the reply. Unfortunately, dropping the --download flag has no affect on the launching of the installer.

if you take a look at these 2 smart group criteria for 'mac catalina compatible' you will see that there is a slight difference. I've added both links, i'm not sure which one is the correct one to use

one has MacBookPro(9|1[0-5] https://github.com/jamf/erase-install-webinar/wiki
while the other has
MacBookPro(9|1[0-6] https://www.jamf.com/blog/reinstall-a-clean-macos-with-one-button/

is there a line I can add to my script, that when the user clicks on this option in the self-service portal, it prompts them to enter a password? which we would then configure to be the password of the supervisor account.

@tcandela, I compared the regex strings from the blog and the GitHub page, but they appear identical to me. The correct one should be MacBookPro(9|1[0-6], which I updated back in November when the MacBook Pro 16-inch was released.

Can you verify for me and let me know if you still see the discrepancy?

@J_JohnstonAT, not sure what you mean by "supervisor account". Do you mean an admin account on the Mac?

The purpose of Self Service is to execute policies with admin privileges, potentially allowing non-admins to perform admin tasks. In Jamf Pro, you can set Self Service to either require a user log in or allow a user to log in. Then, if you scope the policy to specific users, only they can run the policy.

@talkingmoose its still a discrepancy in Github.

This section is correct ' Regular Expression (regex) to identify Catalina-compatible hardware'

But if you scroll down to the 'macOS Catalina Compatible Macs criteria' you have to update it there.

@tcandela, oh, therrrrre it is! I've updated it.

Can you verify one more time?

@davidhiggs I like really the code you shared in this post inform the end-user. I am new to JAMF Pro and do not understand, how and where to implement the code. I think it must be configured in the same policy for the Self-Service, but I've no idea where exactly.

@IT_desktopServices it is probably too big for adding to the execute command option in the policy. Make a new script with the code below, add it the policy and set it to run After whatever you are using to get the Catalina installer to the machine.

#!/bin/bash

userConfirmation=$(osascript <<END 
display dialog "Confirm that you want to reset your Mac and lose all data by typing ERASE" with title "Erase Mac and Install macOS" default answer "" buttons {"Exit","Continue"} default button 1
if button returned of the result = "Continue" then return text returned of the result
END)

if [[ $userConfirmation == ERASE ]]
    then
        echo user confirmed intent to reset Mac and erase all data by typing ERASE
    else
        echo user cancelled Mac reset
        osascript -e 'display dialog "Cancelled." with title "Erase Mac and Install macOS" buttons {"OK"} default button 1'
        exit 0
fi

'/Applications/Install macOS Catalina.app/Contents/Resources/startosinstall' --eraseinstall --agreetolicense --forcequitapps --newvolumename 'Macintosh HD'

Thank you, I will try it.

@davidhiggs THX a lot. It works like en charm -> works perfectly

How is Jamf able to connect back to the system after a clean install?

@mjmclaren, if your devices are enrolled in Apple Business Manager or Apple School Manager, then you can take advantage of automated device enrollment to get them back into Jamf Pro.

I have a test machine that we performed a Recovery on, so it went straight to 10.15.4 yesterday; now running this pulls down a version of Mojave!
Not sure if it's just this machine that's gone a bit strange, so trying to test on another to see if it's the version of the OS or Apple that's the problem.

[EDIT]
Seems to be the update; ran the --fetch-full-installer on a 10.15.3 machine and it's still pulling down Catalina as it should.