Suppress setup assistant after updates installed

[jtrant]

Hello,

We have a number of kiosk Macs that are set to automatically log in and start an application on startup. We use the "softwareupdate" binary to install recommended updates from Apple every week. On occasion, the Macs will reboot to the setup screen where the 'user' is prompted to set up things like Siri. As a result, it requires manual interaction to get the Mac back online.

Is anyone aware of a way to automate the hiding of the setup assistant in cases like this? Since they are kiosk machines they don't have a keyboard or Mac connected to them.

I have tried using a "Software Update" configuration profile in Jamf with the same results.

Thanks a lot,
Justin.

[Hugonaut]

What operating system are the kiosks running? there is a very good chance that you modify some plists and have them deployed to the machines so once they restart, they skip the setup assistant stuff.

[jtrant]

They are a mixture of El Capitan, Sierra and High Sierra Macs. Our Helpdesk folks advised that a second reboot fixed it, so I'm thinking a post-patch policy to reboot might be in order?

[Hugonaut]

You can modify /Users/USERNAME/Library/Preferences/com.apple.SetupAssistant.plist for the Kiosk machines.

Create a launchdaemon & a simple shell script. Have the launchdaemon call the simple shell script at boot, tell the shell script to run sudo jamf policy -event POLICYNAMEHERE. Package both the launchdaemon and shell script and deploy it via a policy to the machines that you are updating, have it deployed on logout / after the update.

Have the policy referencing "POLICYNAMEHERE" that is called in the shell script deploy a modified version of the com.apple.SetupAssistant.plist to the /Users/USERNAME/Library/Preferences/ directory with all the flags set to true. Add a script to that policy to delete the LaunchDaemon and script it calls after the policy is ran.

You can either copy com.apple.SetupAssistant.plist yourself or modify the flags from <false/> in the plist to <true/> & modify <key>RunNonInteractive</key> & <key>SkipFirstLoginOptimization</key>. Again, instead of modifying the plist, you can most likely get away with just copying the plist from an already updated machine that boots and bypasses the prompts.

example >

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>DidSeeApplePaySetup</key>
    <true/>
    <key>DidSeeAvatarSetup</key>
    <true/>
    <key>DidSeeCloudDiagnostics</key>
    <true/>
    <key>DidSeeCloudSetup</key>
    <true/>
    <key>DidSeeSiriSetup</key>
    <true/>
    <key>DidSeeSyncSetup</key>
    <true/>
    <key>DidSeeSyncSetup2</key>
    <true/>
    <key>DidSeeTouchIDSetup</key>
    <true/>
    <key>DidSeeiCloudLoginForStorageServices</key>
    <true/>
    <key>DidSeeiCloudSecuritySetup</key>
    <true/>
    <key>FDECSLVUUIDs</key>
    <array>
        <string>0C20FEC7-754B-45BC-B6D8-F828400EB40E</string>
    </array>
    <key>GestureMovieSeen</key>
    <string>none</string>
    <key>LastCacheCleanupProductVersion</key>
    <string>10.11.4</string>
    <key>LastCacheCleanupStillRunning</key>
    <false/>
    <key>LastPreLoginTasksPerformedBuild</key>
    <string>16G29</string>
    <key>LastPreLoginTasksPerformedVersion</key>
    <string>10.12.6</string>
    <key>LastSeenBuddyBuildVersion</key>
    <string>15G31</string>
    <key>LastSeenCloudProductVersion</key>
    <string>10.12.6</string>
    <key>LastSeenSyncProductVersion</key>
    <string>10.11.6</string>
    <key>PreviousBuildVersion</key>
    <string>0</string>
    <key>PreviousSystemVersion</key>
    <string>0.0.0</string>
    <key>RunNonInteractive</key>
    <false/>
    <key>ShowKeychainSyncBuddyAtLogin</key>
    <true/>
    <key>SkipFirstLoginOptimization</key>
    <false/>
</dict>
</plist>

[jtrant]

Thanks a lot, some great food for thought. Appreciate the help.