SUPER aka S.U.P.E.R.M.A.N. works very well with Nudge (in place of NudgeHelper). This allows Nudge to provide the prompting to the user, but SUPER will run in "download only" mode to prepare updates before the user clicks "Update Now" or the deadline expires.
Setting it up requires a slightly different Config Profile for SUPER than used in SUPER for MacOS Updates - as well as a different Config Profile for Nudge, so that it opens SUPER instead of NudgeHelper for the update action.
Then you also need a Self Service policy to run SUPER with the "--workflow-install-now" option
The user will see the same experience with Nudge:
When they click Update Now or the deadline expires, Nudge will open a Self Service item, eg "Install macOS Updates Now"
On an Apple Silicon Mac, it will prompt for the logged-in user's password:
NOTE: the password will get saved in the user's keychain - next time the Mac needs updates, the user will not be prompted!
On an Intel Mac, or once the user enters their password, they'll see a notification that "This computer will automatically restart very soon"
SETTING UP SUPER+Nudge macOS Updates
NOTE: for all of the examples below, "ENGR - " versions exist in UT Jamf in the ENGR site. There will be templates soon that EPM can clone into your site.
For testing SUPER you will need several configuration profiles in your site (where "SITE" below should be your sitename, e.g ENGR, MECH, COFA, etc).
- Two Configuration Profiles for Apple Software Update settings and notifications:
SITE - Apple Software Update - Disable Notifications
SITE - Apple Software Update Settings
- Two Configuration Profiles, one for the SUPER macos updates settings, and another for the Nudge settings to use SUPER:
SITE - SUPER macos updates settings with Nudge
- This profile has a schema loaded to make adjusting settings easy; you may need to "Add Property" to add settings, e.g from the SUPER wiki
- The parameter "Workflow Only Download" = true is what keeps SUPER in download-only mode
SITE - Nudge with SUPER Settings
- This profile has a schema loaded to make adjusting settings easy
- The parameter 'actionButtonPath' needs to be set to a self-service policy URI which runs SUPER with --workflow-install-now
- Either use one Nudge profile for each major version, or you can combine the versions into a single Nudge profile
- You should create a smart group for your test systems:
SITE - SUPER+Nudge macos update targets
- Create two polices to add the 'accessory' files to be displayed, and to run SUPER itself:
SITE - Add SUPER Accessory Files- This uses script GLOBAL - Add Accessory HTML for SUPER which takes 2 parameters for the HTML to use for the 'macosupdate' and 'macosuserauth' accessory displays used by SUPER
- Give it a custom trigger such as SITE-add-super-files
SITE - Run SUPER for macos updates
- This uses script GLOBAL - SUPER v4 macOS Updates which is SUPER v4.0.3 from https://github.com/Macjutsu/super
- Scope both polices to your SITE - SUPER+Nudge macos update targets group
- Add a custom trigger SITE-run-super
- Create a self-service policy to run SUPER with the '--workflow-install-now' parameter:
SITE - Run SUPER for macOS updates
- In Files and Processes, Execute command, add "/usr/local/bin/super --workflow-install-now &"
- Scope it to your SITE - SUPER+Nudge macos update targets group
- For Self Service give it a display name such as "Install macOS Updates Now"
- copy the self service installation URL, then add it to your SITE - Nudge with SUPER Settings config profile's 'actionButtonPath'
To switch a Mac to SUPER+Nudge for macOS updates, create a policy to run the add-super-files, and and run-super policies:
SITE - Switch to SUPER+Nudge for MacOS Updates
- Scope it your SITE - SUPER+Nudge macos update targets group
- Add script "GLOBAL - Run Policy Triggers"
- Add parameters for SITE-add-super-files, and SITE-run-super
To start testing,
- Add a Mac to your SITE - SUPER+Nudge macos update targets group
- Set the Exception - Nudge EA to 'Yes" for each computer to exclude it from the global Nudge config profiles
- Reinstall Nudge first if you previously used the Mac for SUPER alone
- Set your SITE - Add SUPER Accessory Files policy to Enabled, Ongoing (do not set Recurring Check-in)
- Set your SITE - Run SUPER for macOS updates policies to Enabled, Recurring Check-in, Run Once Per Week
- Set your SITE - Switch to SUPER+Nudge for MacOS Updates policy to Enabled, Recurring Check-in, Run Once Per Computer
- Run "sudo jamf policy" on the Mac to kick things off or just wait for the policies to run.
Once the polices run, SUPER will be installed, and the dialog accessory html files used by SUPER will be copied to /usr/local/epm
SUPER will start running and it will check for any minor updates and pre-download them. It will only install updates when the "Install macOS Updates Now" policy is run - by Nudge, or directly from Self Service.
SUPER auto-installs a LaunchDaemon to run itself at the interval you specify in the configuration file (default 6 hours) - running the policy weekly just ensures that it gets reinstalled if the user removes it - or if a new version of SUPER is uploaded to Jamf (script GLOBAL - SUPER v4 macOS Updates)