Suppressing Setup Assistant After Updates Without DEP

[Mr_Rogers]

Hello all,

I am currently working on doing an in place update to our fleet of 200+ MacOS devices to bring them up to MacOS 10.15.6. However I am encountering trouble with trying to prevent Setup Assistant from running post-upgrade.

Currently after the upgrade is complete and the user unlocks Filevault they are immediately met with the Setup Assistant window which walks them through setting up Siri, Privacy Preferences, Touch ID, ect. This is not ideal as most of the items it prompts for are already managed or restricted within our environment. I know DEP prestages provide the ability to suppress these elements from Startup Assistant, however we are currently not leveraging DEP for our on-prem instance and migrating our existing devices into using DEP is not very feasible currently (hoping to change this in the future).

Based on my researching other threads it looks like the Setup Assistant is triggered based on the existence of the .AppleSetupDone file located in /var/db/ and the preferences for the assistant are managed by the com.apple.SetupAssistant.managed domain. However, it seems like everything I have tried has been met with no success.

Currently I have tried creating an offline policy which would trigger on startup after the update has completed to generate the .AppleSetupDone file if it does not exist already but I am pretty sure the Setup Assistant is running before the jamf client is loaded and can execute the policy as Setup Assistant starts regardless of if the policy has been added to the machine. Or the OS is triggering the Startup Assistant off another flag than this file?

I have also uploaded a custom configuration profile modifying the com.apple.SetupAssistant.managed domain using a profile created using this script. But as far as I can tell this is also not having any effect on the behavior of the assistant.

Has anyone else managed to disable Startup Assistant without using DEP and if so how did you go about it?

[Mr_Rogers · Accepted solution]

Update:
Wound up using the script provided by deflounder on their blog which mostly works! The script seems to suppress the Setup Assistant prompts on most devices. However on some devices the Siri and Security&Privacy prompts still show up. This is acceptable enough for me to be able to move forward with rolling out the update but I would still be interested in hearing if anyone else has had any luck with finding a more reliable method.