“Reinstall a Clean macOS with One Button” webinar resource page

[talkingmoose]

Hi everyone!

For those who attended Jamf’s “Reinstall a Clean macOS with One Button” webinar this week, we’ll have the recording posted hopefully sometime next week. In the meantime, here’s the link to the resources discussed.

https://jamf.it/eraseinstall-webinar

[morsepacific]

My 10.15.4 MacBook Pro this morning started downloading High Sierra with this command (after getting Catalina before).
This is the second machine we've had where, for some unknown reason, the /usr/sbin/softwareupdate --fetch-full-installer command is pulling down the OS that the device shipped with.

[ThierryD]

Since I upgraded to macOS Catalina 10.5.5 I got this error with executing:
/usr/sbin/softwareupdate --fetch-full-installer

Executing Policy Cache Install macOS Catalina.app
Running command /usr/sbin/softwareupdate --fetch-full-installer...
Result of command:
SUPreferenceManager: Failed to set object of class: __NSCFConstantString for key: LastRecommendedMajorOSBundleIdentifier with error: Error Domain=SUPreferenceManagerErrorDomain Code=1 "(null)"
SUPreferenceManager: Failed to set object of class: __NSCFConstantString for key: LastRecommendedMajorOSBundleIdentifier with error: Error Domain=SUPreferenceManagerErrorDomain Code=1 "(null)"
Downloading and installing installer

Install failed with error: Update not found

Does anyone has it too ?

[jschlimmer]

Yea, Apple broke something in softwareupdate when they made the changes in 10.15.5 that'll eventually deprecate the --ignore feature and other stuff.
You have to specify the version number now. It won't just download the latest by default.

[ThierryD]

@jschlimmer Thanks for your feedback. Yeah looks like Apple broke something because even specifying the version it doesn't download it and got these errors:

/usr/sbin/softwareupdate --fetch-full-installer 10.15.5
Downloading and installing installer
SUPreferenceManager: Failed to set object of class: __NSCFConstantString for key: LastRecommendedMajorOSBundleIdentifier with error: Error Domain=SUPreferenceManagerErrorDomain Code=1 "(null)"
SUPreferenceManager: Failed to set object of class: __NSCFConstantString for key: LastRecommendedMajorOSBundleIdentifier with error: Error Domain=SUPreferenceManagerErrorDomain Code=1 "(null)"
Install failed with error: Update not found

I tried also with Catalina 10.15.4

[Captainamerica]

Yes I have same issue on 10.15.5 :(

[ThierryD]

Mine start downloading then stop at 84% ...

[jschlimmer]

@PayFit You need to specify an additional flag in the command to download a specific version.

softwareupdate --fetch-full-installer --full-installer-version 10.15

[sbrammer]

@cserfoss I am also having the same issue as you. We are also running 10.13.6 and HFS, and would like to do a clean install of 10.15 by using the eraseinstall switch.

Did you ever get a response back or get it working?

[snowfox]

@sbrammer You could try doing an upgrade first to 10.15 on a test machine to see if it converts the volume to APFS as part of the upgrade. If it doesn't, and you were going to wipe the machine anyway, you might have to create a bootable USB and wipe the drive that way via it's disk utility before OS install. Disk Utility on 10.15 has the hidden option to 'convert to APFS' but I doubt it can do it on a booted volume. You could also try using Disk Utility from the machines recovery console. It might be able to convert the non booted volume that way. Right click or control click on Disk Utilities toolbar and select customise toolbar. You will see one of the draggable options says 'Convert to APFS'. I can only assume this is also available from the command line 'diskutil' as well for scripting purposes.

[sbrammer]

@snowfox So i did an upgrade to Catalina on another machine and worked fine, so i thought to try out the erase and install on that one. It worked, but since i didn't have any configs set up in the prestage enrollment or enrollment packages selected, it didn't install anything. But i have fixed that, so i may have to do the upgrade first, then run the erase and install.

[EmilDIT]

We've created a package with a postinstall script that we're distributing as a workaround, it's not the best but it works.

[#13]

Much Needed! Need to Install Fresh MacOs! Thanks .

[sbiondio4]

First, thank you so much for this! we have a ton of old machines that we'll be pushing to update, so this is huge! The Catalina script for Catalina machines works like a charm, but I'm having an issue with the Pre-Catalina machines, JAMF shows it pushes and installs properly, but when i check the machine, it's not there, therefore it keeps running at check in.... all of which complete... and i can't test/install Catalina. Any thoughts would be greatly appreciated! Thanks in advance! :)

Edit - Fixed: Realized i packaged the installation file improperly.

[julesj]

Reinstall a Clean macOS with One Button process has been a game-changer for the school network i work for. We added an extra policy forcing the update on Student devices after hours. We just updated 50+ devices Nationally without a hitch, zero-touch!

Thankyou Jamf & Fred!

[walt]

anyone else experiencing issues with this on a 10.15.7 Mac trying to erase and install from Self Service? i even tried manually running the startosinstall command line from terminal but it does not work, self service looks like it runs, finishes and shows done.

something change in these macOS versions?

edit turns out there was something up with the APFS volume 🤷🏻 (though the OS i was on was previously nuked & paved using the self service button)

[tcandela]

I have 10.15.7 in the /Applications folder and have the policy run the following command

'/Applications/Install macOS Catalina.app/Contents/Resources/startosinstall' --agreetolicense --forcequitapps

but it ends of failing, and I see this in the policy log for that computer that it failed on. What is it trying to download? the installer is already on the computer

Result of command:
By using the agreetolicense option, you are agreeing that you have run this tool with the license only option and have read and agreed to the terms.
If you do not agree, press CTRL-C and cancel this process immediately.
Preparing to run macOS Installer...

Preparing: 0.1% Preparing: 0.5% Preparing: 0.9% Preparing: 1.3% Preparing: 1.7% Preparing: 2.1% Preparing: 2.5% Preparing: 2.9% Preparing: 3.3% Preparing: 3.7% Preparing: 4.1% Preparing: 4.5% Preparing: 4.9% Preparing: 5.3% Preparing: 5.6% Preparing: 6.0% Preparing: 6.4% Preparing: 6.8% Preparing: 7.3% Preparing: 7.6% Preparing: 8.0% Preparing: 8.4% Preparing: 8.8% Preparing: 9.2% Preparing: 9.6% Preparing: 10.0% Preparing: 10.4% Preparing: 10.8% Preparing: 11.2% Preparing: 11.6% Preparing: 12.0% Preparing: 12.4% Preparing: 12.8% Preparing: 13.2% Preparing: 13.6% Preparing: 14.0% Preparing: 14.4% Preparing: 14.8% Preparing: 15.2% Preparing: 15.6% Preparing: 16.0% Preparing: 16.4% Preparing: 16.7% Preparing: 17.1% Preparing: 17.5% Preparing: 17.9% Preparing: 18.3% Preparing: 19.6% Preparing: 20.8% Preparing: 21.4% Preparing: 22.6% Preparing: 23.1% The operation couldn’t be completed. (PKDownloadError error 8.)

[sdagley]

@tcandela Do your Macs have access to Apple's update servers? (See Use Apple products on enterprise networks for a list of those servers) If this Mac is a T2 equipped machine it could be that a bridegOS update is required for Catalina, and that requires downloading as part of the macOS install process.

[Strannik]

@talkingmoose Hi talkingmoose! Please share your wisdom! I'm looking for ways to simplify Catalina deployment and wonder if it is possible to use startosinstall --installpackage flag to install Catalina 10.15.7 Security Update right after HD has been wiped and Catalina reinstalled, but before Mac is re-enrolled in Jamf? I've got the pkg, but not sure how to deploy it. I can't save it anywhere on Macintosh HD, along with Catalina installer, because I think it will be wiped when I use --eraseinstall flag.
So is there any way to do it?

[talkingmoose]

@Strannik, I think you've got the right idea. You want to copy the PKG to some location like /private/tmp on the Mac along with the Catalina installer. When you call the startosinstall command and add the --installpackage option, supply the full path to the 10.15.7 Security Update package file. As part of the process, the package should get copied to the temporary second partition along with the macOS installer and get installed from there. You shouldn't have to jump through any other hoops.

[bclaringbold]

If I do a clean install of Big Sur (11.2.3) on system with Jamf that’s DEP enrolled is there anyway around have to touch the system to go through the first few 'Welcome to MacOS' screens before the Remote Management piece runs?

[Strannik]

@bclaringbold You can configure "Automatically advance through Setup Assistant (macOS 11 or later only)" in PreStage. Computer will be enrolled and Remote Management policy can run before you even login.

[bclaringbold]

@Strannik Thank you for that. Didnt know that was added.

[PE2000]

Does this method work on Big Sur?

many thanks in advance

[Strannik]

@PE2000 Yes, Big Sur is macOS 11

[rhooper]

@talkingmoose Thank you for all your wisdom in this process. Is there an updated script for Big Sur clean install?
We have many devices to prep for retirement and with the OS install stick taking over 1 hr, and sometimes fails, that is a load of work. It would be great if there were a script that could be added to Self Service and all we need to do is select it and walk away... well checking it periodically too, but mostly hands off until after the prompt screen shows up.
Thanks loads for all your work on this blog chain.

[rhooper]

@talkingmoose I was able to use the scripts for Big Sur install.... BUT
I could run them from the command line fine anyway but not using JAMF Pro to push them out.
Attached is the script and the results.
Any help is greatly appreciated. I was able to get the upgrade only, from Catalina 15.x to 11.2.3, to work just fine, so am thinking it has to do with either the --newvolumename or the --forcequitapps switches.

AHHHH made it to 100% though. But does not wipe the drive, but that same command works in Terminal with sudo and the admin password.

Thanks all.

[talkingmoose]

@rhooper, running the command either in a policy's Execute Command field or as a script put into Self Service should work. I like that workflow. You've definitely got the right command with no errors or else it wouldn't even start.

One of the problems with running a policy that executes something else that'll restart the Mac is the Mac will restart while the policy is running. Try adding an ampersand & at the end of the startosinstall command to put it in the background. It may seem to finish very quickly, but the command should still be running in the background and eventually restart the Mac.

[rhooper]

@talkingmoose That worked! Guess there was a timing issue occurring. What does the & do? In google and office it concatenates. Scripting is not my forte.
You also mentioned setting up a caching server. Which we have done, but it seems to take just as long to download the Installer with it than it did without it.
Is there a method to see if it is actually working like it should? Or maybe I missed something, a video to set one up?
Thanks for all your expertise.

[rhooper]

I wonder if it is possible to add in the WiFi and password into the script and have it create this on the new image. A script just runs line by line until completed, right? But the fresh install may trump that script. Please correct me if I am overthinking this or if I am not thinking about it in terms of reimaging.

[talkingmoose]

@rhooper, glad to hear!

Normally, scripts are sequential. One command has to finish before the script will continue to the next. The ampersand & takes the command that it follows and spins it into its own process apart from the script running it. That allows the rest of the script to continue although the process may not yet be complete. In this case, it's allowing the policy to come to completion before the startosinstall command restarts the Mac.

Content Caching servers are great for speeding up deployments. I discussed them a little in the webinar how to enable it and determine how well it's working for you.

For lots of documentation and advanced configuration information, refer to Apple's pages.

There may be a way to initiate Wi-Fi using a script in a package that you deploy with the startosinstall command, but if you need your Mac connected to a network after erasing and installing, a wired connection would be a lot more reliable and easier to do.

[PE2000]

@rhooper

Hi are you able to share working script?

Many thanks!!!

[beeboo]

you can also add something like this to your script if you want better validation, where you output the process result to a file and just read a line or the file after X time like i did.
Part of my issue was that I wasn't sure when the installer would be all good and ready and didnt want the script to just finish like a cliffhanger.

This has worked out pretty well for me as an additional check.

An alternative i could see happened in is to do a check of the osinstaller or osinstallersetup or whatever the process is called and once the installer had finished you could echo a statement back, but when i wrote my script about a year ago there was some confusion/issues with the name of the process not being consistent, cutting in and out, or something to that effect, so I deemed it (at the same) not a viable and ideal solution to my problem.

Reading the file also lets me know if the installer hangs - I did a bunch of a tests and 10 minutes was roughly about 80-90% completion, if not fully completed. We had cases where, for some reason, the installer would hang on something or a user would forcible (knowingly or unknowingly) break the process. Showing the user the result of the script or seeing it as admins would help us narrow down or identify the issue at hand.

You can also apple the same process to the downloading of the installer too if you wanted.
I prefer not to cache the file (especially when the final release/builds arent out) as it leads to more checking and uploading to JSS.
Untested, but theoretically possible and i see no reason for this not to work, you can run the full fetch installer command to get, say, 10.15.7 directly from Apple then follow up with the script, eliminating the need for composer and caching.

/Applications/Install macOS Catalina.app/Contents/Resources/startosinstall --agreetolicense --forcequitapps --nointeraction --rebootdelay=120 >> /private/tmp/catalinaUPGRADElog.txt 2>&1 &
                        sleep 10
                        if [[ -e /private/tmp/catalinaUPGRADElog.txt ]]; then
                            sleep 600
                            echo "Preview of log, 10 minutes in"
                            cat /private/tmp/catalinaUPGRADElog.txt | grep "Preparing:" | tail -1
                        else
                            echo "No log file found"
                            { /bin/kill "${caffeinatePID}"; } 2>/dev/null
                            { /usr/bin/killall jamfHelper; } 2>/dev/null
                            exit 1
                        fi

[rhooper]

@PE2000 This is a 2-step process; download the install macOS Big Sur and then a clean install.

The script we use to download the Install macOS Big Sur.app that worked for us is #!/bin/bash
softwareupdate --fetch --full-installer-version 11.2.3

The script to install it #!/bin/bash
"/Applications/Install macOS Big Sur.app/Contents/Resources/startosinstall" --agreetolicense --eraseinstall --forcequitapps --newvolumename 'Macintosh HD' &

By removing the two switches --eraseinstall and --newvolumename 'enter name here' we were able to perform an OS update while retaining the users data.

After each of these policies is run we perform an "Update Inventory" maintenance.

@talkingmoose After the Install MacOS.app downloads into the Applications folder. the next policy, "erase and Install" seems to take over 2 hrs to complete. I have been timing it with a User Interaction message, "Erase and install started", and timing it from that notification message on. Is this normal? not as fast as an image stick, but still less time spent touching every device.

[PE2000]

@rhooper

Thank you Very Much. I will give that a go and see what kinds of results I get.

[talkingmoose]

@rhooper, two hours to complete? Seems pretty long.

Should take just a few seconds to create the temporary partition. Then a couple of minutes to copy the installer to the temporary partition.

From there, I've seen the installer take about 20-30 minutes depending on the hardware.

You can troubleshoot by taking Jamf completely out of the mix. Run the command in Terminal without the ampersand & and watch the output. That may give you an idea where the process is slowing.

[rhooper]

@talkingmoose talkingHaha, that is exactly what i did, took about 28 minutes complete. So now it begs the question, why? I agonna try it again qithout the ampersand and see if goes. Ithere are any ideas please post it.
Thanks all
~r