SuperV4.0.2 triggered MDM update without visual cues - SUS No GUI user currently logged in When I was

[master-vodawagner]

I think the logic that checks for a logged in user isn't working accurately, I was most definitely logged in when this kicked off the MDM update and triggered the restart with no visual cues. Luckily I didn't have any vital stuff going on when it rebooted :P

Wed Dec 06 08:31:45 X2102825 super-starter[552]: **** S.U.P.E.R.M.A.N. 4.0.2 - LAUNCHDAEMON ****
Wed Dec 06 08:31:45 X2102825 super[604]: **** S.U.P.E.R.M.A.N. 4.0.2 - SUPER STARTUP WORKFLOW ****
Wed Dec 06 08:31:45 X2102825 super[604]: Status: Mac computer with Apple silicon running: macOS  14.2-23C5055b
Wed Dec 06 08:31:45 X2102825 super[604]: Status: Last macOS startup was: 2023-12-06:08:31:00
Wed Dec 06 08:31:46 X2102825 super[604]: Status: No GUI user currently logged in.
Wed Dec 06 08:31:48 X2102825 super[604]: Status: System is managed by Jamf Pro 11.1.0 hosted at: https://<OBSCURED>.jamfcloud.com/
Wed Dec 06 08:31:49 X2102825 super[604]: Status: Deleting local preference for the --deadline-days-soft option.
Wed Dec 06 08:31:49 X2102825 super[604]: Status: macOS update/upgrade workflows automatically authenticated via Jamf Pro API with --auth-mdm-failover-to-user=ALWAYS.
Wed Dec 06 08:31:49 X2102825 super[604]: **** S.U.P.E.R.M.A.N. 4.0.2 - CHECK SOFTWARE UPDATES/UPGRADE ****
Wed Dec 06 08:31:49 X2102825 super[604]: Status: Last Apple software update check was more than 6 hours ago, full update/upgrade check required.
Wed Dec 06 08:31:59 X2102825 super[604]: Status: This system is currently configured to receive macOS beta updates/upgrades.
Wed Dec 06 08:31:59 X2102825 super[604]: Status: Starting full check for all available system software...
Wed Dec 06 08:31:59 X2102825 super[604]: softwareupdate: Waiting for available Apple software updates...
Wed Dec 06 08:33:55 X2102825 super[604]: Status: A macOS minor update is available: macOS Sonoma 14.2-23C63
Wed Dec 06 08:33:55 X2102825 super[604]: Status: No available non-system Apple software updates or they may be deferred via configuration profile.
Wed Dec 06 08:33:55 X2102825 super[604]: mdmclient: Waiting for available macOS major upgrades...
Wed Dec 06 08:34:01 X2102825 super[604]: Status: No available macOS major upgrades or they may be deferred via configuration profile.
Wed Dec 06 08:34:01 X2102825 super[604]: **** S.U.P.E.R.M.A.N. 4.0.2 - MACOS 14.2 MINOR UPDATE ****
Wed Dec 06 08:34:03 X2102825 super[604]: Status: MDM service is currently available at: https://<OBSCURED>.jamfcloud.com/
Wed Dec 06 08:34:04 X2102825 super[604]: Status: Bootstrap token escrowed and validated with MDM service.
Wed Dec 06 08:34:05 X2102825 super[604]: Status: Validated saved credentials for the --auth-jamf-client option.
Wed Dec 06 08:34:05 X2102825 super[604]: MDM: Starting macOS 14.2 download and update workflow with user authenticated failover.
Wed Dec 06 08:34:05 X2102825 super[604]: MDM: check /Library/Management/super/logs/mdm-command.log and /Library/Management/super/logs/mdm-workflow.log for more detail.
Wed Dec 06 08:34:05 X2102825 super[604]: Status: Restarting various softwareupdate daemon processes...
Wed Dec 06 08:34:15 X2102825 super[604]: MDM: Successful macOS update/upgrade command request.
Wed Dec 06 08:34:39 X2102825 super[604]: MDM: Received push command "ScheduleOSUpdateScan", checking back after Jamf Pro's mandatory 5 minute delay...
Wed Dec 06 08:40:05 X2102825 super[604]: MDM: Jamf Pro's mandatory 5 minute delay should be complete, sending Blank Push...
Wed Dec 06 08:41:35 X2102825 super[604]: MDM: Received blank push.
Wed Dec 06 08:41:41 X2102825 super[604]: MDM: Received push command "AvailableOSUpdates".
Wed Dec 06 08:41:59 X2102825 super[604]: MDM: Received blank push.
Wed Dec 06 08:41:59 X2102825 super[604]: MDM: Received push command "ScheduleOSUpdate", local update/upgrade workflow should start soon...
Wed Dec 06 08:41:59 X2102825 super[604]: MDM: macOS Sonoma 14.2-23C63 update is downloading...
Wed Dec 06 08:54:03 X2102825 super[604]: MDM: macOS Sonoma 14.2-23C63 update download complete, now preparing...
Wed Dec 06 09:09:50 X2102825 super[604]: MDM: macOS Sonoma 14.2-23C63 update is prepared and ready for restart!
Wed Dec 06 09:09:50 X2102825 super[604]: Exit: Full super workflow complete! macOS update/upgrade restart is imminent and the super restart validation workflow is scheduled to automatically relaunch at next startup.
Wed Dec 06 09:09:51 X2102825 super[604]: **** S.U.P.E.R.M.A.N. 4.0.2 - CLEAN EXIT ****

[master-vodawagner]

Looking at the timing, its very close to when I powered on the Mac..............wonder if the LaunchDaemon triggered before the Desktop had loaded

[blakeusblade]

We have the same issue...

super.log mdm-workflow.log

[master-vodawagner]

I'm going to test if this would be a suitable workaround until @Macjutsu looks into this longer term, fortuantely for my org we don't have a situation where Macs are in a non logged in state.....

# Make sure we have a "normal" logged in user.
dockStatus=$(pgrep -x Dock)
if [[ -z "${current_user_account_name_response}" ]] && [[ "$dockStatus" == "" ]]; then

[Macjutsu]

Indeed the problem is that the new super LD is so fast that it starts up before the user has a chance to log back in... this will take some logic changes to accommodate correctly.

For example, should super wait for a login... but what about computers (like lab/servers) that may sit a the login window for a very long time... not a straight forward fix here.

[master-vodawagner]

Hmm 🤔 would another argument be to have an option to configure for lab computers and set that via config profile?

least that way you could scope logic accordingly

[Macjutsu]

Resolving this issue is enough of a super workflow change that it will require at least one new feature/option.

As such it will be resolved in the next minor point update.

[icebook2]

Just fyi, had this happen on an M1 Pro running Sonoma using super 4.0.3. Updating from OS 14.3 to 14.3.1 the machine just restarted with no dialog. Checked the log and it showed no gui user currently logged in, but I was. It does appear the update workflow had started before I logged in. Then did not recognize an account was active after preparing the update. Other than this it's been working great.

[master-vodawagner]

Still not working as expected just wondered @Macjutsu whether another logic check of "Is the user logged in" could be added at this point of super perhaps?

Thu Feb 15 08:53:54 super[332]: softwareupdate: macOS Sonoma 14.4 Beta 3 download complete, now preparing... Thu Feb 15 09:21:34 super[332]: softwareupdate: macOS update/upgrade is prepared and ready for restart!

[master-vodawagner]

Possibly something like the below on LN5791

current_user_account_name_response=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ {$1=$2="";print $0;}' | xargs)
	if [[ -z "${current_user_account_name_response}" ]]; then
		current_user_account_name=FALSE
		log_super "Final logged in user check, no GUI user found"
	else
		current_user_account_name=TRUE
		log_super "Final logged in user check, GUI user ${current_user_account_name_response} found"
	fi

[Macjutsu]

Please try the latest release of super as it may resolve this issue: https://github.com/Macjutsu/super/releases/tag/v4.1.0-beta1

[master-vodawagner]

Please try the latest release of super as it may resolve this issue: https://github.com/Macjutsu/super/releases/tag/v4.1.0-beta1

Will be the first thing I try when I’m back at work in June

[Macjutsu]

There are many updates in https://github.com/Macjutsu/super/releases/tag/v5.0.0-beta2 that may resolve this behavior. Please try it out.