What is the best way to upgrade Macs from Monterey to Ventura?

[howie_isaacks]

I have been trying and failing over and over today to get Graham Pugh's erase-install to work.

https://github.com/grahampugh/erase-install

Sometimes it works but too often it doesn't. It often fails during the preparing stage before macOS Ventura installs. Other times, it finishes the preparation of the install and then does nothing. The Mac reboots. No install happens. I have literally spent my entire day today working with it. I thought maybe one of our security agents could have been interfering. I read about this possibility in the FAQ for erase-install. I have been running my tests from a Mac with no security agents installed. If someone has worked with this solution and been successful with it, I would love to know how you did it. The scenario is that we have several Macs that need to get upgraded to Ventura. The users are mostly standard user accounts on both Apple Silicon and Intel. When this has worked, I haven't had to do anything special to get non-admin users to be able to install Ventura. Right now it seems that the only way I'm going to get this to work is to promote a bunch of users to admin and just have them manually run the installer. I did ask this question in the erase-install Slack but I guess everyone is busy with JNUC right now. I wasn't able to attend this year 😟

[AJPinto]

Do it the way Apple Suggest.

• Use MDM Commands (JAMF Mass Actions)
• Allow the users to manage OS updates themselves (bad idea)

macOS Upgrades and Updates Using a Mass Action Command - Technical Paper: Deploying macOS Upgrades a...

[PaulHazelden]

I use Fetch full installer app to get the latest version of the OS that I require. Upload that to the server. Then a policy will install it, putting the Installer for the OS in the Applications folder.
Then I use the startosinstall command without the eraseinstall modifier. Add this as a script and set it to run after other processes, then add it to the policy.
Then scope the policy to wherever you want it to go.
I only use this approach on our Lab macs, and out of hours. There will be warnings for the end user. If it is on Silicon Macs you will need to send the admin password to the command too.
Laptops get this in a selfservice policy, and they are warned that it will reboot and take time.

[howie_isaacks]

@PaulHazelden I was considering trying this and I may well end up doing it this way. Graham Pugh's erase-install puts a nice interface on the process. That's really the only reason I wanted to use it. I haven't learned Swift Dialog well enough to throw something together in a short time but this will be my incentive to do that after I get this behind me and I can take time to focus on it. I have often used the fetch full installer command in a policy so the end points do the work of downloading the macOS installer without me having to upload it into Jamf Pro. I also have a script that downloads the Install Assistant package to a hidden location and then it runs the package to place the macOS installer in /Applications. I think either method of getting the installer onto the target systems will work well.

@AJPinto I was reading about this method this morning. I'm going to give it a try first because it will be the easiest method if it works.

I am restoring my test Mac back to macOS Monterey right now. When it's ready I will enroll it and then try both of these methods to see which one will work best for my situation. Once I have everyone on Ventura, Nudge can handle the updates. It would have worked for upgrading from Monterey to Ventura, but there are way too many users who are not admins.

Have I mentioned yet how much I HATE the Captcha prompts?

[howie_isaacks]

This is annoying 😡 How can this be "unsupported"? It's a 2020 13-inch M1 MacBook Pro. It's currently running macOS 12.6. Looking through a lot of the Mac inventory, I have seen this in management history. Apparently, the person who had my job before me tried this in April. All of the Macs that I saw with this in their management history showed that it failed and that it was "unsupported".

[PaulHazelden]

I have found over time the Mass action commands are less and less successful. Even more so are the Silicon Macs.
They want authorisation from the Secure token holder account. And the new Software updates feature seems to not work most of the time.
It seems every iteration of OSX has more security built in, and that prevents us from managing multiple Macs.
The only way so far that I have had success is with the startosinstall command. Still not 100% perfect, but better than all the methods I have tried.
I get to send the version of OSX I want on them, and I get to force it to install.
The Self Service version works for the end users - all not admins.

I would guess the unsupported bit is because the task was not done by the Secure Token user account.

[howie_isaacks]

I'm going to work on the other solution of getting the macOS installer onto the Macs and then using startosinstall. I wanted this to look nicer but I'm under a deadline to get these systems on Ventura ASAP.

[PaulHazelden]

You can make it all a bit neater with Jamf Notify or similar. Wrap the startosinstall with notification windows  to inform the user. When we jump to Sonoma I will sort one out for our laptop users. Just a couple of windows to let them know what stage it is at. And a caffeinate command to keep the laptop awake for the process.

[mark_lynch]

@howie_isaacks do your users have admin or the ability to elevate to admin? We've been using Nudge. It's quite literally a fresh deployment of Macs so we were ranging anything from 12.x all the way up. Found that Nudge when combined with good instructions and a good amount of leeway, has been giving us good progress. Then with the CVE's that came out recently, we went full send on the rest of the fleet which is going great. A big disclaimer for us, is that we're 100% Apple Silicon.

[howie_isaacks]

Nudge is great. I deployed it last week. It took a while to get it rolled out due to our testing process, and I had other things that had to take priority. A week later as of today, my number of Macs running macOS 13.5.2 is at over 1000 up from just over 100. Our macOS Ventura versions were all over the place. 13.2, 13.3, 13.3.1, 13.4. it was driving me nuts. We delay macOS updates to make sure that the latest update won't break a lot of things in our enviroment. Soon, I will change Nudge to start alerting about macOS 13.6 and update the profile we have setup to delay the updates to allow 13.6. Yesterday, I redeployed the profile that controls Nudge to the 29 Macs running Monterey where the user is an admin. Software Update will now offer macOS Ventura to those users. If they instead opt to just update Monterey, Nudge will keep prompting them until they upgrade to Ventura. I think your idea of temporarily elevating the other users to admin is a good one. I just need to make sure proper communication is put out before I do that. For the record, I don't really see a big benefit to not allowing users to be admins since Apple has over the years been slowly neutering "admin" accounts. They started this with the introduction of System Integrity Protection in OS X El Capitan and they later separated the system space from the user's space in macOS Catalina. We can't tinker with macOS the way we used to be able to do. I did a lot of it back in the old days of the macOS Versions with cat names, starting with Mac OS X 10.0 beta. Malware protection and some well thought out restrictions will take care of the potential threats that admin users may pose.