super icon indicating copy to clipboard operation
super copied to clipboard

Configuration Profiles Keep "Rolling" Deferrals

Open majorsl opened this issue 1 year ago • 20 comments

I noted that my test Sequoia machine should have received the 15.1 update by now. So, I started watching a few days ago.

We have a configuration profile via Intune that defers minor updates for 2 days.

TWO days ago Super said: Restrictions Deferral: macOS minor update 1 of 1 is: DeferredUntil:2024-11-01 00:00:00,Title:macOS Sequoia 15.1,Build:24B83,Version:15.1

I just ran it NOW, 2 days later, and should have been offered 15.1. Instead: Restrictions Deferral: macOS minor update 1 of 1 is: DeferredUntil:2024-11-03 00:00:00,Title:macOS Sequoia 15.1,Build:24B83,Version:15.1

It just bumped it 2 more days?! I have a feeling this has been happening since it was available.

Ideas? Log below.

  Fri Nov 01 19:41:16 MAC40400 super[77565]: **** S.U.P.E.R.M.A.N. 5.0.0 - SUPER STARTUP **** Fri Nov 01 19:41:17 MAC40400 super[77565]: Status: Mac computer with Apple silicon running: macOS Sequoia 15.0.1-24A348 Fri Nov 01 19:41:17 MAC40400 super[77565]: Status: Last macOS startup was: 2024-10-11:09:56:43 Fri Nov 01 19:41:17 MAC40400 super[77565]: Status: Current active GUI user is: testmac (1714728167) Fri Nov 01 19:41:17 MAC40400 super[77565]: Warning: Automatic download of macOS updates is currently enabled, this can result in updates being downloaded outside of super workflows. Fri Nov 01 19:41:19 MAC40400 super[77565]: Status: macOS update/upgrade workflows automatically authenticated via saved local account. Fri Nov 01 19:41:19 MAC40400 super[77565]: **** S.U.P.E.R.M.A.N. 5.0.0 - CHECK FOR SOFTWARE UPDATES/UPGRADES **** Fri Nov 01 19:41:19 MAC40400 super[77565]: Status: Restrictions configuration profile is deferring macOS major upgrades for 45 days. Fri Nov 01 19:41:19 MAC40400 super[77565]: Status: Restrictions configuration profile is deferring macOS minor updates for 2 days. Fri Nov 01 19:41:19 MAC40400 super[77565]: Status: Restrictions configuration profile is deferring non-system updates for 1 days. Fri Nov 01 19:41:19 MAC40400 super[77565]: Status: Some updates are deferred due to a restrictions deferral configuration profile. Fri Nov 01 19:41:19 MAC40400 super[77565]: Restrictions Deferral: macOS minor update 1 of 1 is: DeferredUntil:2024-11-03 00:00:00,Title:macOS Sequoia 15.1,Build:24B83,Version:15.1 Fri Nov 01 19:41:19 MAC40400 super[77565]: Status: No currently available macOS software updates due to software update deferral restrictions configuration profile. Fri Nov 01 19:41:20 MAC40400 super[77565]: Status: Resetting any workflow dates. Fri Nov 01 19:41:20 MAC40400 super[77565]: Status: Resetting any deadline counters. Fri Nov 01 19:41:20 MAC40400 super[77565]: Status: Full super workflow complete! The super workflow is scheduled to automatically relaunch in 360 minutes. Fri Nov 01 19:41:20 MAC40400 super[77565]: Exit: super is scheduled to automatically relaunch at: 2024-11-02:01:41:00 Fri Nov 01 19:41:20 MAC40400 super[77565]: **** S.U.P.E.R.M.A.N. 5.0.0 - EXIT CLEAN ****

majorsl avatar Nov 01 '24 23:11 majorsl

I'm seeing the same behaviour. I use a config profile to set the deadline at 7 days after the client detects the update.

I have one client that was set to update by Oct 31, now the zero-date and deadline have been reset to Nov 2 and Nov 9. This client is still on 14.5.0. I can't access the logs, but it looks like superman has been rolling the dates into the future and never forcing an update.

ofirgalcon avatar Nov 03 '24 16:11 ofirgalcon

I just checked a Mac in one of our other areas where we are ready for Sonoma. We have major OS updates delayed for 45 days. It actually seems to have rolled that into late December.

majorsl avatar Nov 04 '24 20:11 majorsl

To be clear... super does NOT determine the deferral date... the system does.

super is simply reacting to the output of the mdmclient command. I've updated the wiki with more detail... but basically these dates come from the system... not super.

https://github.com/Macjutsu/super/wiki/Troubleshooting#mdmclient-listlog

I'll leave this open for now, but I suspsect there isn't anything wrong with super as it's just getting those dates from the mdmclient command.

Macjutsu avatar Nov 04 '24 20:11 Macjutsu

In my case the deferral is 18 days, but these clients have missed on several updates as they keep resetting their zero date. It's very hard to follow, so I wrote a MunkiReport module to help track things, based around the Jamf EAs

image image

This client is still at 14.5.0

ofirgalcon avatar Nov 04 '24 20:11 ofirgalcon

Interesting... I have a group with Sequoia approved. Digging into it a little more, some are not getting their deferrals rolled - yet being in the same group they should all have identical config profiles.

majorsl avatar Nov 04 '24 20:11 majorsl

Just to make sure you are aware... the default behavior of super's zero day is based on when super first found an update.... not the actual zero day of the update's release.

https://github.com/Macjutsu/super/wiki/Workflow-Schedule-Behavior https://github.com/Macjutsu/super/wiki/Workflow-Schedule-Behavior#schedule-zero-date-macos-release

Macjutsu avatar Nov 05 '24 17:11 Macjutsu

Yes that's exactly what I want, install 7 days after discovering the update. It seems that's where the issue is, it keeps on 're-discovering'

ofirgalcon avatar Nov 05 '24 17:11 ofirgalcon

I would have to see the full super.log of a device that is affected.

However, if you want the MOST consistent behavior then use --schedule-zero-date-release and then adjust your deadlines accordingly. Further, this should work in conjunction with your deferral restrictions config profile. For example, if you are deferring updates for 18 days... then super shouldn't start prompting untill that deferral is expired. Then set your super deadline for 18+7 days instead of just 7.

Macjutsu avatar Nov 05 '24 17:11 Macjutsu

I wanted to but what happens if a user is away and returns past the deadline? does the computer force an update straight away?

ofirgalcon avatar Nov 05 '24 17:11 ofirgalcon

I wanted to but what happens if a user is away and returns past the deadline? does the computer force an update straight away?

Good question! I might do that as well. In my mind, it would/should start a 7 day deferral option at that point, from a cyber security standpoint, it isn't my employer's problem if someone was away while a potentially critical update became available and it should be applied asap.

majorsl avatar Nov 05 '24 18:11 majorsl

I agree but there should be a grace period. Some of the users only open their laptop 5 minutes before a zoom call and then shut it down for days. Under the SOFA scenario it will start to update and they wont be able to stop it just before a meeting.

ofirgalcon avatar Nov 05 '24 19:11 ofirgalcon

You can always set the timer for the dialog to an extended period, a several hours perhaps, so in that scenario if they started a zoom call they wouldn’t need to restart right away. Or just have set the focus deferral count so it doesn’t bother them at all during the zoom call. On Nov 5, 2024, at 12:09 PM, ofir @.***> wrote: I agree but there should be a grace period. Some of the users only open their laptop 5 minutes before a zoom call and then shut it down for days. Under the SOFA scenario it will start to update and they wont be able to stop it just before a meeting.

—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you are subscribed to this thread.Message ID: @.***>

ghost avatar Nov 05 '24 22:11 ghost

You can always set the timer for the dialog to an extended period, a several hours perhaps, so in that scenario if they started a zoom call they wouldn’t need to restart right away.

I'm actually testing this right now. You all inspired me.

majorsl avatar Nov 05 '24 22:11 majorsl

Hi all,

I believe I see an issue that might be related to this thread.

We are planning to move from a 7-day deferral to a 14-day deferral for minor updates, with a 7-day deadline for completing the update, making it 14+7 in total.

I am testing Super by performing an update from macOS Sequoia 15.0.1 to 15.1. Everything works correctly with the original 7-day deferral: the deferral has expired, and the Super workflow starts as expected, downloading and preparing the update before prompting the user.

However, when switching to a 14-day deferral, I’m observing the following:

Wed Nov 13 10:47:27 hostname super-starter[5050]: **** S.U.P.E.R.M.A.N. 5.0.0 - LAUNCHDAEMON ****\
Wed Nov 13 10:47:27 hostname super[5099]: **** S.U.P.E.R.M.A.N. 5.0.0 - SUPER STARTUP ****\
Wed Nov 13 10:47:28 hostname super[5099]: Status: Mac computer with Apple silicon running: macOS Sequoia 15.0.1-24A348\
Wed Nov 13 10:47:28 hostname super[5099]: Status: Last macOS startup was: 2024-11-13:10:15:48\
Wed Nov 13 10:47:28 hostname super[5099]: Status: Current active GUI user is: username (502)\
Wed Nov 13 10:47:30 hostname super[5099]: Status: Managed by Jamf Pro 11.10.2 hosted at: https://company.jamfcloud.com/\
Wed Nov 13 10:47:30 hostname super[5099]: Parameter Warning: The --display-notifications-centered type of DIALOG is ignored because dialogs are not notifcations.\
Wed Nov 13 10:47:31 hostname super[5099]: Status: macOS update/upgrade workflows automatically authenticated via saved password for current user: username\
Wed Nov 13 10:47:31 hostname super[5099]: **** S.U.P.E.R.M.A.N. 5.0.0 - CHECK FOR SOFTWARE UPDATES/UPGRADES ****\
Wed Nov 13 10:47:31 hostname super[5099]: Status: Deferral restrictions have changed since last super workflow run, full software status check required.\
Wed Nov 13 10:47:31 hostname super[5099]: Status: Restrictions configuration profile is deferring macOS major upgrades for 90 days.\
Wed Nov 13 10:47:31 hostname super[5099]: Status: Restrictions configuration profile is deferring macOS minor updates for 14 days.\
Wed Nov 13 10:47:32 hostname super[5099]: mdmclient: Waiting for available updates listing...\
Wed Nov 13 10:47:36 hostname super[5099]: Status: Some updates are deferred due to a restrictions deferral configuration profile.\
Wed Nov 13 10:47:36 hostname super[5099]: Warning: Some updates are inaccurately reporting as deferred even though restrictions deferral configuration is not enabled. As such, these updates will still be considered for installation.\
Wed Nov 13 10:47:36 hostname super[5099]: Restrictions Deferral: macOS minor update 1 of 1 is: DeferredUntil:2024-11-18 00:00:00,Title:macOS Sequoia 15.1,Build:24B83,Version:15.1\
Wed Nov 13 10:47:36 hostname super[5099]: Status: No currently available macOS software updates due to software update deferral restrictions configuration profile.\
Wed Nov 13 10:47:36 hostname super[5099]: Status: Resetting any workflow dates.\
Wed Nov 13 10:47:36 hostname super[5099]: Status: Resetting any deadline counters.\
Wed Nov 13 10:47:36 hostname super[5099]: Status: Full super workflow complete! The super workflow is scheduled to automatically relaunch in 360 minutes.\
Wed Nov 13 10:47:36 hostname super[5099]: Exit: super is scheduled to automatically relaunch at: 2024-11-13:16:47:00\
Wed Nov 13 10:47:36 hostname super[5099]: **** S.U.P.E.R.M.A.N. 5.0.0 - EXIT CLEAN ****\

The workflow does not start as expected. Although the update appears in Software Update as 15.1 was released more than 14 days ago (16 according to Sofa) and the deferral expired, the workflow fails to initiate.

What am I missing? Where does the DeferredUntil:2024-11-18 00:00:00 I see in the logs come from?

I-Wildcard avatar Nov 14 '24 09:11 I-Wildcard

You can always set the timer for the dialog to an extended period, a several hours perhaps, so in that scenario if they started a zoom call they wouldn’t need to restart right away. Or just have set the focus deferral count so it doesn’t bother them at all during the zoom call.

This is something that I also wanted to set up but wasn't able to, as it seems that if the deadline has already passed, the timer for the dialog (DialogTimeoutSoftDeadline) is capped to 120 seconds before automatically restarting the device to complete the update. If there was a way to set it to something like 2 hours, I'd go for the option you suggested.

I-Wildcard avatar Nov 14 '24 10:11 I-Wildcard

This is also what I observed. The update was available in Software Update but never offered by super.

On Thu, Nov 14, 2024 at 4:31 AM I-Wildcard @.***> wrote:

Hi all,

I believe I see an issue that might be related to this thread.

We are planning to move from a 7-day deferral to a 14-day deferral for minor updates, with a 7-day deadline for completing the update, making it 14+7 in total.

I am testing Super by performing an update from macOS Sequoia 15.0.1 to 15.1. Everything works correctly with the original 7-day deferral: the deferral has expired, and the Super workflow starts as expected, downloading and preparing the update before prompting the user.

However, when switching to a 14-day deferral, I’m observing the following:

Wed Nov 13 10:47:27 hostname super-starter[5050]: **** S.U.P.E.R.M.A.N. 5.0.0 - LAUNCHDAEMON ****
Wed Nov 13 10:47:27 hostname super[5099]: **** S.U.P.E.R.M.A.N. 5.0.0 - SUPER STARTUP ****
Wed Nov 13 10:47:28 hostname super[5099]: Status: Mac computer with Apple silicon running: macOS Sequoia 15.0.1-24A348
Wed Nov 13 10:47:28 hostname super[5099]: Status: Last macOS startup was: 2024-11-13:10:15:48
Wed Nov 13 10:47:28 hostname super[5099]: Status: Current active GUI user is: username (502)
Wed Nov 13 10:47:30 hostname super[5099]: Status: Managed by Jamf Pro 11.10.2 hosted at: https://company.jamfcloud.com/
Wed Nov 13 10:47:30 hostname super[5099]: Parameter Warning: The --display-notifications-centered type of DIALOG is ignored because dialogs are not notifcations.
Wed Nov 13 10:47:31 hostname super[5099]: Status: macOS update/upgrade workflows automatically authenticated via saved password for current user: username
Wed Nov 13 10:47:31 hostname super[5099]: **** S.U.P.E.R.M.A.N. 5.0.0 - CHECK FOR SOFTWARE UPDATES/UPGRADES ****
Wed Nov 13 10:47:31 hostname super[5099]: Status: Deferral restrictions have changed since last super workflow run, full software status check required.
Wed Nov 13 10:47:31 hostname super[5099]: Status: Restrictions configuration profile is deferring macOS major upgrades for 90 days.
Wed Nov 13 10:47:31 hostname super[5099]: Status: Restrictions configuration profile is deferring macOS minor updates for 14 days.
Wed Nov 13 10:47:32 hostname super[5099]: mdmclient: Waiting for available updates listing...
Wed Nov 13 10:47:36 hostname super[5099]: Status: Some updates are deferred due to a restrictions deferral configuration profile.
Wed Nov 13 10:47:36 hostname super[5099]: Warning: Some updates are inaccurately reporting as deferred even though restrictions deferral configuration is not enabled. As such, these updates will still be considered for installation.
Wed Nov 13 10:47:36 hostname super[5099]: Restrictions Deferral: macOS minor update 1 of 1 is: DeferredUntil:2024-11-18 00:00:00,Title:macOS Sequoia 15.1,Build:24B83,Version:15.1
Wed Nov 13 10:47:36 hostname super[5099]: Status: No currently available macOS software updates due to software update deferral restrictions configuration profile.
Wed Nov 13 10:47:36 hostname super[5099]: Status: Resetting any workflow dates.
Wed Nov 13 10:47:36 hostname super[5099]: Status: Resetting any deadline counters.
Wed Nov 13 10:47:36 hostname super[5099]: Status: Full super workflow complete! The super workflow is scheduled to automatically relaunch in 360 minutes.
Wed Nov 13 10:47:36 hostname super[5099]: Exit: super is scheduled to automatically relaunch at: 2024-11-13:16:47:00
Wed Nov 13 10:47:36 hostname super[5099]: **** S.U.P.E.R.M.A.N. 5.0.0 - EXIT CLEAN ****\

The workflow does not start as expected. Although the update appears in Software Update as 15.1 was released more than 14 days ago (16 according to Sofa) and the deferral expired, the workflow fails to initiate.

What am I missing? Where does the DeferredUntil:2024-11-18 00:00:00 I see in the logs come from?

— Reply to this email directly, view it on GitHub https://github.com/Macjutsu/super/issues/250#issuecomment-2475839078, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAXWE6JMMTUAPUWQD5R7TO32ARUY5AVCNFSM6AAAAABRBEQF4GVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINZVHAZTSMBXHA . You are receiving this because you authored the thread.Message ID: @.***>

majorsl avatar Nov 14 '24 11:11 majorsl

super is simply reacting to the output of the mdmclient command.

Ok, so I did a bit of digging here, and I can see that the output of the mdmclient command for 15.1 (with a 14-day deferral) is:

 {
        AllowsInstallLater = 1;
        AppIdentifiersToClose =         (
        );
        Build = 24B83;
        DeferredUntil = "2024-11-18 00:00:00 +0000";
        DownloadSize = 2925530947;
        HumanReadableName = "macOS Sequoia 15.1";
        HumanReadableNameLocale = "en-US";
        IsConfigDataUpdate = 0;
        IsCritical = 0;
        IsFirmwareUpdate = 0;
        IsSecurityResponse = 0;
        ProductKey = "MSU_UPDATE_24B83_patch_15.1_minor";
        RequiresBootstrapToken = 1;
        RestartRequired = 1;
        SupplementalBuildVersion = 24B83;
        Version = "15.1";
    },

DeferredUntil = "2024-11-18 00:00:00 is the reason why Super's workflow isn't starting.

I am very confused though, because as far as I know macOS Sequoia 15.1 was released on October 28th, and the 14-days deferral should have expired on the 2024-11-11 00:00:00, not on the 2024-11-18 00:00:00. To confirm this, I am actually already able to see the update as available in Software Update.

mdmclient doesn't seem to be reliable in this case - at least I understand where the issue comes from, but I'm not sure why it's setting a different date.

I-Wildcard avatar Nov 14 '24 13:11 I-Wildcard

I still have no idea what is happening here. Originally, 15.1 was deferred until 12/09/24 for us. Then 15.1.1 was released and now the major OS update got pushed back for 12/24/24. Obviously, if Apple keeps releasing minor updates before the major deferral time us up, in theory you'd never get to the point where the major update is allowed.

I'm going to decrease the deferral time in our MDM and hope that it gets honored.

majorsl avatar Nov 22 '24 14:11 majorsl

I have the same issue of my workflow counter being reset while the Mac is lid closed It runs the software update check but since the lid is closed it doesn't receive any updates and it constantly resets my workflow:

`Sat Feb 15 09:05:59 V957K0900R super[29067]: **** S.U.P.E.R.M.A.N. 5.0.0 - SUPER STARTUP **** Sat Feb 15 09:05:59 V957K0900R super[29067]: Status: Mac computer with Apple silicon running: macOS Sonoma 14.7.2-23H311 Sat Feb 15 09:06:00 V957K0900R super[29067]: Status: Last macOS startup was: 2025-02-05:21:10:34 Sat Feb 15 09:06:00 V957K0900R super[29067]: Status: Current active GUI user is: nicolasramos (501) Sat Feb 15 09:06:00 V957K0900R super[29067]: Warning: Automatic download and installation of macOS updates is currently enabled, this can result in updates being installed outside of super workflows. Sat Feb 15 09:06:01 V957K0900R super[29067]: Status: Managed by Jamf Pro 11.13.1 hosted at: https://priceline.jamfcloud.com/ Sat Feb 15 09:06:01 V957K0900R super[29067]: Status: macOS update/upgrade workflows automatically authenticated via Jamf Pro API with --auth-mdm-failover-to-user=ALWAYS. Sat Feb 15 09:06:01 V957K0900R super[29067]: **** S.U.P.E.R.M.A.N. 5.0.0 - CHECK FOR SOFTWARE UPDATES/UPGRADES **** Sat Feb 15 09:06:01 V957K0900R super[29067]: Status: Last macOS software update check was more than 6 hours ago, full software status check required. Sat Feb 15 09:06:02 V957K0900R super[29067]: mdmclient: Waiting for available updates listing... Sat Feb 15 09:10:22 V957K0900R super[29067]: softwareupdate: Waiting for available updates listing... Sat Feb 15 09:26:37 V957K0900R super[29067]: Status: Resetting any workflow dates. Sat Feb 15 09:26:37 V957K0900R super[29067]: Status: Resetting any deadline counters. Sat Feb 15 09:26:37 V957K0900R super[29067]: Status: Full super workflow complete! The super workflow is scheduled to automatically relaunch in 360 minutes. Sat Feb 15 09:26:37 V957K0900R super[29067]: Exit: super is scheduled to automatically relaunch at: 2025-02-15:15:26:00 Sat Feb 15 09:26:37 V957K0900R super[29067]: **** S.U.P.E.R.M.A.N. 5.0.0 - EXIT CLEAN **** Sat Feb 15 16:41:34 V957K0900R super-starter[32911]: **** S.U.P.E.R.M.A.N. 5.0.0 - LAUNCHDAEMON **** Sat Feb 15 16:41:34 V957K0900R super[32926]: **** S.U.P.E.R.M.A.N. 5.0.0 - SUPER STARTUP **** Sat Feb 15 16:41:34 V957K0900R super[32926]: Status: Mac computer with Apple silicon running: macOS Sonoma 14.7.2-23H311 Sat Feb 15 16:41:34 V957K0900R super[32926]: Status: Last macOS startup was: 2025-02-05:21:10:34 Sat Feb 15 16:41:34 V957K0900R super[32926]: Status: Current active GUI user is: nicolasramos (501) Sat Feb 15 16:41:35 V957K0900R super[32926]: Warning: Automatic download and installation of macOS updates is currently enabled, this can result in updates being installed outside of super workflows. Sat Feb 15 16:41:36 V957K0900R super[32926]: Status: Managed by Jamf Pro 11.13.1 hosted at: https://priceline.jamfcloud.com/ Sat Feb 15 16:41:37 V957K0900R super[32926]: Status: macOS update/upgrade workflows automatically authenticated via Jamf Pro API with --auth-mdm-failover-to-user=ALWAYS. Sat Feb 15 16:41:37 V957K0900R super[32926]: **** S.U.P.E.R.M.A.N. 5.0.0 - CHECK FOR SOFTWARE UPDATES/UPGRADES **** Sat Feb 15 16:41:37 V957K0900R super[32926]: Status: Last macOS software update check was more than 6 hours ago, full software status check required. Sat Feb 15 16:41:38 V957K0900R super[32926]: mdmclient: Waiting for available updates listing... Sat Feb 15 16:59:07 V957K0900R super[32926]: softwareupdate: Waiting for available updates listing... Sat Feb 15 17:15:48 V957K0900R super[32926]: Status: Resetting any workflow dates. Sat Feb 15 17:15:48 V957K0900R super[32926]: Status: Resetting any deadline counters. Sat Feb 15 17:15:48 V957K0900R super[32926]: Status: Full super workflow complete! The super workflow is scheduled to automatically relaunch in 360 minutes. Sat Feb 15 17:15:48 V957K0900R super[32926]: Exit: super is scheduled to automatically relaunch at: 2025-02-15:23:15:00 Sat Feb 15 17:15:48 V957K0900R super[32926]: **** S.U.P.E.R.M.A.N. 5.0.0 - EXIT CLEAN **** Sun Feb 16 00:22:14 V957K0900R super-starter[34405]: **** S.U.P.E.R.M.A.N. 5.0.0 - LAUNCHDAEMON **** Sun Feb 16 00:22:14 V957K0900R super[34420]: **** S.U.P.E.R.M.A.N. 5.0.0 - SUPER STARTUP **** Sun Feb 16 00:22:14 V957K0900R super[34420]: Status: Mac computer with Apple silicon running: macOS Sonoma 14.7.2-23H311 Sun Feb 16 00:22:14 V957K0900R super[34420]: Status: Last macOS startup was: 2025-02-05:21:10:34 Sun Feb 16 00:22:14 V957K0900R super[34420]: Status: Current active GUI user is: nicolasramos (501) Sun Feb 16 00:22:14 V957K0900R super[34420]: Warning: Automatic download and installation of macOS updates is currently enabled, this can result in updates being installed outside of super workflows. Sun Feb 16 00:22:15 V957K0900R super[34420]: Status: Managed by Jamf Pro 11.13.1 hosted at: https://priceline.jamfcloud.com/ Sun Feb 16 00:38:16 V957K0900R super[34420]: Status: macOS update/upgrade workflows automatically authenticated via Jamf Pro API with --auth-mdm-failover-to-user=ALWAYS. Sun Feb 16 00:38:16 V957K0900R super[34420]: **** S.U.P.E.R.M.A.N. 5.0.0 - CHECK FOR SOFTWARE UPDATES/UPGRADES **** Sun Feb 16 00:38:16 V957K0900R super[34420]: Status: Last macOS software update check was more than 6 hours ago, full software status check required. Sun Feb 16 00:38:18 V957K0900R super[34420]: mdmclient: Waiting for available updates listing... Sun Feb 16 00:55:40 V957K0900R super[34420]: softwareupdate: Waiting for available updates listing... Sun Feb 16 01:13:33 V957K0900R super[34420]: Status: Resetting any workflow dates. Sun Feb 16 01:13:33 V957K0900R super[34420]: Status: Resetting any deadline counters. Sun Feb 16 01:13:33 V957K0900R super[34420]: Status: Full super workflow complete! The super workflow is scheduled to automatically relaunch in 360 minutes. Sun Feb 16 01:13:33 V957K0900R super[34420]: Exit: super is scheduled to automatically relaunch at: 2025-02-16:07:13:00 Sun Feb 16 01:13:33 V957K0900R super[34420]: **** S.U.P.E.R.M.A.N. 5.0.0 - EXIT CLEAN **** Sun Feb 16 09:09:35 V957K0900R super-starter[35899]: **** S.U.P.E.R.M.A.N. 5.0.0 - LAUNCHDAEMON **** Sun Feb 16 09:09:35 V957K0900R super[35914]: **** S.U.P.E.R.M.A.N. 5.0.0 - SUPER STARTUP **** Sun Feb 16 09:09:35 V957K0900R super[35914]: Status: Mac computer with Apple silicon running: macOS Sonoma 14.7.2-23H311 Sun Feb 16 09:09:35 V957K0900R super[35914]: Status: Last macOS startup was: 2025-02-05:21:10:34 Sun Feb 16 09:09:35 V957K0900R super[35914]: Status: Current active GUI user is: nicolasramos (501) Sun Feb 16 09:09:35 V957K0900R super[35914]: Warning: Automatic download and installation of macOS updates is currently enabled, this can result in updates being installed outside of super workflows. Sun Feb 16 09:09:36 V957K0900R super[35914]: Status: Managed by Jamf Pro 11.13.1 hosted at: https://priceline.jamfcloud.com/ Sun Feb 16 09:09:37 V957K0900R super[35914]: Status: macOS update/upgrade workflows automatically authenticated via Jamf Pro API with --auth-mdm-failover-to-user=ALWAYS. Sun Feb 16 09:09:37 V957K0900R super[35914]: **** S.U.P.E.R.M.A.N. 5.0.0 - CHECK FOR SOFTWARE UPDATES/UPGRADES **** Sun Feb 16 09:09:37 V957K0900R super[35914]: Status: Last macOS software update check was more than 6 hours ago, full software status check required. Sun Feb 16 09:11:36 V957K0900R super[35914]: mdmclient: Waiting for available updates listing... Sun Feb 16 09:11:41 V957K0900R super[35914]: softwareupdate: Waiting for available updates listing... Sun Feb 16 09:11:49 V957K0900R super[35914]: Target: "Over-the-air" macOS major upgrade macOS Sequoia 15.3.1-24D70 which is a 8GB download. Sun Feb 16 09:11:49 V957K0900R super[35914]: Status: Setting new automatic zero date based on the macOS Sequoia 15.3.1-24D70 workflow start date of 2025-02-16:09:11. Sun Feb 16 09:11:49 V957K0900R super[35914]: **** S.U.P.E.R.M.A.N. 5.0.0 - macOS Sequoia 15.3.1-24D70 MAJOR UPGRADE VIA SOFTWAREUPDATE **** Sun Feb 16 09:11:49 V957K0900R super[35914]: softwareupdate: Starting macOS Sequoia download workflow, check /Library/Management/super/logs/msu-workflow.log for more detail. Sun Feb 16 09:11:58 V957K0900R super[35914]: softwareupdate: macOS Sequoia 15.3.1 is downloading... Sun Feb 16 09:11:58 V957K0900R super[35914]: softwareupdate: macOS Sequoia 15.3.1 download and preparation complete. Sun Feb 16 09:11:59 V957K0900R super[35914]: Status: Focus days deadline of 2025-02-17 (1 day(s) after 2025-02-16:09:11) not passed. Sun Feb 16 09:11:59 V957K0900R super[35914]: Status: Soft days deadline of 2025-02-18 (2 day(s) after 2025-02-16:09:11) not passed. Sun Feb 16 09:11:59 V957K0900R super[35914]: Status: Hard days deadline of 2025-02-19 (3 day(s) after 2025-02-16:09:11) not passed. Sun Feb 16 09:11:59 V957K0900R super[35914]: IBM Notifier: User choice dialog with a 600 second timeout. Sun Feb 16 09:12:06 V957K0900R super[35914]: Status: User chose to defer for 15 minutes. Sun Feb 16 09:12:06 V957K0900R super[35914]: Exit: super is scheduled to automatically relaunch at: 2025-02-16:09:27:00 Sun Feb 16 09:12:06 V957K0900R super[35914]: **** S.U.P.E.R.M.A.N. 5.0.0 - EXIT CLEAN ****'

sKThreat-sys avatar Feb 18 '25 17:02 sKThreat-sys

Hi,

did anyone ever figure this out? How do you handle it?

"Obviously, if Apple keeps releasing minor updates before the major deferral time us up, in theory you'd never get to the point where the major update is allowed." (Comment from above) looks like the issue for me too. Reducing the Deferral time is an option for now, but i'm open for better ideas.. PLEASE :`)

raylinger avatar Jul 29 '25 13:07 raylinger