Restricting Mojave Beta

[dennisnardi]

Can anyone confirm what the process name of the Mojave beta install is so I can put a restriction on it in my environment? I'm assuming it's "Install macOS Mojave.app"

[damienbarrett]

I'd like to know this also. I still haven't gotten my email from AppleSeed with the download link(s).

For whatever reason, I've never been able to get the config profile that restricts beta installations to work properly. I also like the email alerts that a restricted process gives me. Lets me address the issue in a one-on-one conversation with a student who is trying to upgrade. Whereas, the config profile just forces a silent fail.

[chad_jannusch]

We have a configuration profile in place:

Preference domain: com.apple.SoftwareUpdate
Property list file: {AllowPreReleaseInstallation=false}

and as far as I know that'll at least restrict it from appearing in the App Store however I'm not sure it'll stop somebody bringing the actual app file over to upgrade.

[waqas_khan]

I believe the process to restrict is "Install macOS 10.14 Beta.app"

[g2oIT]

Yup, this policy will block them from being able to download through the App Store. You could potentially look to block the macOS Developer Beta Access utility packae installer, but even if that runs, it still launches the App Store and blocks it.

[kevinfriel]

Can confirm that "Install macOS 10.14 Beta.app" is successfully blocking the install through Restricted Software. Not too many attempts yet, but we've seen a few.

[Dylan_YYC]

@kevinfriel how are you logging the attempt?

[seansb]

@Dylan_YYC When you set up Restricted Software, you can enable email notification to notify you on violation. I believe these violations are also logged in the JAMFSoftwareServer.log (I think it's that one).

[donmontalvo]

Not sure AllowPreReleaseInstallation is a supported key anymore, as it doesn't show up in Apple's Configuration Profile Reference page (last updated 2018-06-04).

But shouldn't hurt if combined with forceDelayedSoftwareUpdates and enforcedSoftwareUpdateDelay (set to 90 in our case).

Combined with restricting the launch of the Beta installer...

[dgreening]

@donmontalvo AllowPreReleaseInstallation still seems to be working for me!

[segan]

Not sure if it has changed since Beta 1, but the process name for Beta 2 installer is "Install macOS Mojave Beta.app" not "Install macOS 10.14 Beta.app" for those that are using Restricted Software via JAMF.

[kerouak]

It's called: Install macOS Mojave Beta.app
just D/L'd it...

[daniel_ross]

Is anyone being more aggressive with blocking this as all a user would have to do is change the name of the installer to bypass this?

We'd almost like to block it at a process level as we have some users that will get creative as I mentioned above.

[donmontalvo]

@daniel_ross true, but not sure if a user can change a process name.

[kevinfriel]

@Dylan_YYC Sorry for the delay in responding. crazy summer.
We have an email alert going out for the restricted software attempts.
We have a restriction for the beta utility installer and the OS install app.
macOSPublicBetaAccessUtility and Install macOS 10.14*
changing process names could be an issue, but we don't see much of it.
I have a smart group with 10.14 Macs that I keep track of. during beta we don't see much...users are accustomed to asking for access...only took 3 years to get there. :-)

[dstranathan]

Im in the opposite situation.

Now that were are fairly far along in the 10.14 beta track (dev beta 6 out now), Im trying to allow the Mojave dev beta on a few IT Macs for testing. Even after explicitly setting Exclusion Scopes for the IT dept (and even excluding specific Mac computers too) the Mac App Store still prevents the installation of the Mojave beta via the Developer Beta Access Utility.pkg

The key/value pair of "AllowPreReleaseInstallation" in com.apple.SoftwareUpdate.plist never changes from "False" on the target/excluded Macs. The Config Profiles look like they are up-to-date.

I have tried iMacs and MacBook Pros ranging in vintages (2013, 2015 and 2017 hardware - all of which fail to understand the Jamf profile exclusion scope.

Even after removing the "beta blocker" profile from ALL my managed Macs, I still can't install the Mojava beta! The Mac App Store says its blocked.

I'm currently on Jamf Pro 10.3.1

[dstranathan]

FINALLY figured it out.

Totally forgot that the Software Update MDM payload has a checkbox "Allow installation of macOS Beta releases" - which is DISABLED by default.

So I enabled it and then created a separate Restriction Policy to block/delete/notify the "Install macOS Mojave Beta.app" application (and excluded IT Dept Mac computers for testing of course).

In the past I had an explicit MDM profile that restricted macOS by setting the key/value pair of 'AllowPreReleaseInstallation' to 'False'. I removed this profile as it isn't needed any longer.

I literally spent a few hours tracking this checkbox down. Doh! One of those unproductive days...

[rhooper]

@dstranathan Looks like you nailed it. Does it work as expected?

Does this just block Mojave Beta's or all updates including Mojave? We need not only block the Beta's but also the Full Mojave OS when it is available... at least until we can test it out fully with our in-house SW.
Does this block all updates to say 10.13.5 to 10.13.6?

I tried this server, but could not resolve the Update server Apple posts online. Is this the correct swuserver within this image? We use the JAMF Cloud distro, nit an in-house distro.

I am just getting ready to try another stab at it and would like to get this operational before the little Cherubs return to school. LOL Especially the hackers!

If anyone has any scripts or ideas I would like to hear from you.

Thanks all and enjoy the rest of your day.

[cwaldrip]

Just setup Software Update MDM payload to block prerelease software since I can't block the macOSPublicBetaAccessUtility.pkg now. Let's see if it works for 10.15 Beta...