Self Service downgrade from Mojave to High Serra - no longer working in 10.14.1

[jtrant]

Hello all,

I've been working on a Self Service policy that will perform a clean install of High Sierra 10.13.6 no a Mac running Mojave. This basically involved a policy that staged "Install macOS High Sierra.app" compatible with the Mac in question in /Applications and ran it using the "startosinstall" binary as follows:

/Applications/Install macOS High Sierra.app/Contents/Resources/startosinstall --applicationpath /Applications/Install macOS High Sierra.app --eraseinstall --newvolumename "Macintosh HD" --agreetolicense --nointeraction

This worked great in 10.14.0 but for some reason appears to be broken in 10.14.1. The installer launches and states:

Preparing to run macOS installer...
Permission denied

When I try to open the installer package manually I see a message stating "This copy of the "Install macOS" application is too old to be opened on this version of macOS". If I create a bootable USB (which is something I'm trying to avoid) using the exact same installer as the source, I can boot to it and do an erase install manually just fine.

Might anyone have some insight as to what changed? I'm ideally trying to find a way to downgrade to High Sierra until we can support Mojave, in a way that's easy for our Helpdesk folks.

The methodology used is a variant of: https://www.jamf.com/blog/reinstall-a-clean-macos-with-one-button

Thanks in advance,
Justin.

[sshort]

a couple of things to try...

-Does Terminal have a PPPC profile to whitelist SystemPolicyAllFiles and/or SystemPolicySysAdminFiles?
-I've used the --agreetolicense flag before, but --nointeraction is not in the startosintall --usage page. That flag is listed for createinstallmedia --usage but not startosinstall

[woodsb]

What model are you running the script on? I believe the new 2018 models with the T2 chips are no longer able to be rolled back.

[gachowski]

@jtrant

I saw the same thing today during a tests of a different issue....It wasn't on a T2 chip machine... I have install startosinstall scripts for 13.6, all the betas. 14.0 and 14.1....all have ran over 100 times just fine but today when It was my 1st try to downgrade a 14.1 machine with the 13.6 script set up it failed "Permission denied" . That said I got 14.1 to downgrade the 14.0 with no issue..but there should be no need for that.. I was just double checking my testing methods...

I was able to netboot to a 13.6 netboot installer and get 13.6 installed on the machine with nothing special going on...

C

[jtrant]

Very interesting, it seems to be specific to 10.4.1. I'm trying to avoid NetBoot but I might have to go down that route.
Out of interest, did you use Jamf Imaging to block copy High Sierra? I didn't think that would work with APFS drives.

[gachowski]

Nope just a straight finder copy..

C

[erowan]

@jtrant @gachowski Curious: HDD, SSD, or Fusion internal drives?

[gachowski]

Touchbar MBP and some older MBP and Airs

C

[jtrant]

I never found a workaround on this, or a reason for the "Permission denied" message. Did anyone have better luck?

[sdagley]

@jtrant If you're at 10.14.1 or higher on a T2 MacBook Pro you first have to downgrade to 10.14.0 before you'll be able to downgrade to 10.13.6. Note that if the MacBook Pro came with the Radeon Pro Vega option added a few months after introduction it will probably require 10.14.1 or higher.

[jtrant]

Very interesting, do you know what changed with 10.14.1? Gotta love these undocumented "features" within Mojave!

[sdagley]

@jtrant I don't think Apple has ever publicly commented on why the behavior changed after Mojave 10.14.0. The discovery of the intermediate downgrade trick was reported in the #highsierra MacAdmins Slack channel.

[jtrant]

Thanks a lot for your help. Back to the drawing board, currently using USB keys to downgrade Mojave Macs to High Sierra for deployment.

[dmillertds]

Sorry to resurrect an old thread, but this is the only place I've seen that talks about downgrading from Mojave to High Sierra using the installer app. We just got a new load of iMacs running 10.14.5, and I'd dearly love to get them on 10.13.6 without using USB drives! Is there any reasonable way to do this? Even netbooting, if that's what it takes.

[jtrant]

I just saw this response. Apparently not, the older OS installer can not be opened from within the newer OS:
https://www.jamf.com/blog/reinstall-a-clean-macos-with-one-button/

You cannot use the ‑‑eraseinstall argument to downgrade a Mac from Mojave back to High Sierra. The High Sierra installer won’t run on the Mojave operating system. The Mac must boot to an external volume where the administrator can then run Disk Utility to erase the disk and install the older software.

NetBoot is no longer possible with APFS drives, but I think I remember seeing some posts online about a workaround.
Unfortunately the solutions for us this year is USB keys - lots of them.