Big Sur & "softwareupdate -a -i --restart" ?

[panjandrum]

In what is either a Big Sur or and M1 issue, I'm now unable to send the "softwareupdate -a -i --restart" command via ARD or through or MDM (Mosyle), both of which either result in 'authentication' errors or the claim that 'root access' is required (ARD is set to send the command as root). I have no problems with Intel systems running Mojave or Catalina. I do not have any Intel systems currently running Big Sur to test. I have not disabled SIP on any of these systems, so I do not believe this is an SIP issue. This is a relatively serious issue as it leaves me unable to update our M1 Macs without manually doing so (even if I set the machines to automagically download and install all updates, something that could be really disruptive in a school environment, our students don't know the admin password and the machines ask for the admin password during the process, making that method hands-on as well).

Any thoughts? Anyone else here figured out how to initiate that command properly on M1's/Big Sur?

 

[panjandrum]

No bites? I'm at a loss how to update a fleet of school Macs without physically touching each one if I can't get this to work. I mean, realistically I'll be touching the majority of them anyway, since so many of them are laptops I have to remove from charging carts for the update, but the more of it I can automate the better obviously.

 

[chrfr]

No bites? I'm at a loss how to update a fleet of school Macs without physically touching each one if I can't get this to work. I mean, realistically I'll be touching the majority of them anyway, since so many of them are laptops I have to remove from charging carts for the update, but the more of it I can automate the better obviously.

M1 Macs must be updated with an MDM command, otherwise they will all need an admin password entered to install updates. Sending "softwareupdate" will not work even through the MDM unless you're going to type that password in by hand. I'm not familiar with how that's done in Mosyle, but that's the process.
Here's a good blog post on the topic: https://babodee.wordpress.com/2020/...-updates-on-macos-running-on-apple-silicon-2/

 

[panjandrum]

M1 Macs must be updated with an MDM command, otherwise they will all need an admin password entered to install updates. Sending "softwareupdate" will not work even through the MDM unless you're going to type that password in by hand. I'm not familiar with how that's done in Mosyle, but that's the process.
Here's a good blog post on the topic: https://babodee.wordpress.com/2020/...-updates-on-macos-running-on-apple-silicon-2/

Thank you! That's exactly the info I needed to know. It confirms what my communications with Mosyle are leaning-towards; there there is no effective way of managing updates on M1 Macs in many environments. We can't turn on the auto-update feature, since students don't know the admin passwords on the computers of course, and would therefore be unable to authenticate the updates; if that was even something we ever wanted to do (which it is not). Looks like our M1s simply won't be updated in a timely manner unless Apple takes fixes this issue in the future. But for that to happen, Apple has to first come to the understanding that it is a problem.

 

[chrfr]

Thank you! That's exactly the info I needed to know. It confirms what my communications with Mosyle are leaning-towards; there there is no effective way of managing updates on M1 Macs in many environments. We can't turn on the auto-update feature, since students don't know the admin passwords on the computers of course, and would therefore be unable to authenticate the updates; if that was even something we ever wanted to do (which it is not). Looks like our M1s simply won't be updated in a timely manner unless Apple takes fixes this issue in the future. But for that to happen, Apple has to first come to the understanding that it is a problem.

It does not seem that Apple so far has any interest in making Macs any easier for organizations to manage, but you should talk to your rep and/or file with Enterprise Support if you have that available.