We have a Mac which installed the macOS 13.5.1 update in the afternoon at 14:48.
This is confirmed by the user as the install.log (/var/log/install.log)
In the afternoon at 14:36 a script was running which checks and reads the macOS version. The corresponding policy log says that he still had macOS 13.5 installed at this time (14:36).
This is another confirmation that the user has made the macOS 13.5.1 update in the afternoon at 14:48.
Now to the unclear:
In the Jamf under "Hardware and Software history" it shows that he already installed the update in the morning at 09:54:
From where did Jamf get this info?
Has anyone else observed this?
(We have not observed this phenomenon on any other device)