Restricting Mojave Beta

dennisnardi
Contributor

Can anyone confirm what the process name of the Mojave beta install is so I can put a restriction on it in my environment? I'm assuming it's "Install macOS Mojave.app"

18 REPLIES 18

damienbarrett
Valued Contributor

I'd like to know this also. I still haven't gotten my email from AppleSeed with the download link(s).

For whatever reason, I've never been able to get the config profile that restricts beta installations to work properly. I also like the email alerts that a restricted process gives me. Lets me address the issue in a one-on-one conversation with a student who is trying to upgrade. Whereas, the config profile just forces a silent fail.

chad_jannusch
New Contributor II

We have a configuration profile in place:

Preference domain: com.apple.SoftwareUpdate
Property list file: {AllowPreReleaseInstallation=false}

and as far as I know that'll at least restrict it from appearing in the App Store however I'm not sure it'll stop somebody bringing the actual app file over to upgrade.

waqas_khan
New Contributor III

I believe the process to restrict is "Install macOS 10.14 Beta.app"

g2oIT
New Contributor II

Yup, this policy will block them from being able to download through the App Store. You could potentially look to block the macOS Developer Beta Access utility packae installer, but even if that runs, it still launches the App Store and blocks it.

6e6bf65d41434ac2a0cfd70632d81d04

kevinfriel
Contributor

Can confirm that "Install macOS 10.14 Beta.app" is successfully blocking the install through Restricted Software. Not too many attempts yet, but we've seen a few.

Dylan_YYC
Contributor III

@kevinfriel how are you logging the attempt?

seansb
New Contributor III

@Dylan_YYC When you set up Restricted Software, you can enable email notification to notify you on violation. I believe these violations are also logged in the JAMFSoftwareServer.log (I think it's that one).

donmontalvo
Esteemed Contributor III

Not sure AllowPreReleaseInstallation is a supported key anymore, as it doesn't show up in Apple's Configuration Profile Reference page (last updated 2018-06-04).

But shouldn't hurt if combined with forceDelayedSoftwareUpdates and enforcedSoftwareUpdateDelay (set to 90 in our case).

b5625a4422074b4ca42b003d405b848b

Combined with restricting the launch of the Beta installer...

--
https://donmontalvo.com

dgreening
Valued Contributor II

@donmontalvo AllowPreReleaseInstallation still seems to be working for me!

segan
New Contributor II

Not sure if it has changed since Beta 1, but the process name for Beta 2 installer is "Install macOS Mojave Beta.app" not "Install macOS 10.14 Beta.app" for those that are using Restricted Software via JAMF.

kerouak
Valued Contributor

It's called: Install macOS Mojave Beta.app
just D/L'd it...

daniel_ross
Contributor III

Is anyone being more aggressive with blocking this as all a user would have to do is change the name of the installer to bypass this?

We'd almost like to block it at a process level as we have some users that will get creative as I mentioned above.

donmontalvo
Esteemed Contributor III

@daniel_ross true, but not sure if a user can change a process name.

--
https://donmontalvo.com

kevinfriel
Contributor

@Dylan_YYC Sorry for the delay in responding. crazy summer.
We have an email alert going out for the restricted software attempts.
We have a restriction for the beta utility installer and the OS install app.
macOSPublicBetaAccessUtility and Install macOS 10.14*
changing process names could be an issue, but we don't see much of it.
I have a smart group with 10.14 Macs that I keep track of. during beta we don't see much...users are accustomed to asking for access...only took 3 years to get there. :-)

dstranathan
Valued Contributor II

Im in the opposite situation.

Now that were are fairly far along in the 10.14 beta track (dev beta 6 out now), Im trying to allow the Mojave dev beta on a few IT Macs for testing. Even after explicitly setting Exclusion Scopes for the IT dept (and even excluding specific Mac computers too) the Mac App Store still prevents the installation of the Mojave beta via the Developer Beta Access Utility.pkg

The key/value pair of "AllowPreReleaseInstallation" in com.apple.SoftwareUpdate.plist never changes from "False" on the target/excluded Macs. The Config Profiles look like they are up-to-date.

I have tried iMacs and MacBook Pros ranging in vintages (2013, 2015 and 2017 hardware - all of which fail to understand the Jamf profile exclusion scope.

Even after removing the "beta blocker" profile from ALL my managed Macs, I still can't install the Mojava beta! The Mac App Store says its blocked.

I'm currently on Jamf Pro 10.3.1

239717b457d04d5ea046638bc4c5b2fe

dstranathan
Valued Contributor II

FINALLY figured it out.

Totally forgot that the Software Update MDM payload has a checkbox "Allow installation of macOS Beta releases" - which is DISABLED by default.

So I enabled it and then created a separate Restriction Policy to block/delete/notify the "Install macOS Mojave Beta.app" application (and excluded IT Dept Mac computers for testing of course).

In the past I had an explicit MDM profile that restricted macOS by setting the key/value pair of 'AllowPreReleaseInstallation' to 'False'. I removed this profile as it isn't needed any longer.

I literally spent a few hours tracking this checkbox down. Doh! One of those unproductive days...

ff58d2e6b38a4f01ad8261a81cab70ef

rhooper
Contributor III

@dstranathan Looks like you nailed it. Does it work as expected?

Does this just block Mojave Beta's or all updates including Mojave? We need not only block the Beta's but also the Full Mojave OS when it is available... at least until we can test it out fully with our in-house SW.
Does this block all updates to say 10.13.5 to 10.13.6?

I tried this server, but could not resolve the Update server Apple posts online. Is this the correct swuserver within this image? We use the JAMF Cloud distro, nit an in-house distro.

I am just getting ready to try another stab at it and would like to get this operational before the little Cherubs return to school. LOL Especially the hackers!

If anyone has any scripts or ideas I would like to hear from you.

Thanks all and enjoy the rest of your day.

cwaldrip
Valued Contributor

Just setup Software Update MDM payload to block prerelease software since I can't block the macOSPublicBetaAccessUtility.pkg now. Let's see if it works for 10.15 Beta...