S.U.P.E.R.M.A.N. II: Encourage and enforce macOS updates and upgrades with scripting and workflows

S.U.P.E.R.M.A.N., an acronym for Software Update Policy Enforcement with Recursive Messaging And Notifications, is an open-source script that provides administrators with an automatic workflow to encourage and enforce macOS updates and upgrades.

The script aims to help admins overcome issues like variations between OS versions and targets, limited enforcement and deferral options, insufficient user messaging, and unfriendly user interfaces, among others. In just one year, super has been adopted by hundreds of organizations and has patched thousands of macOS computers.

In this session, Kevin presented the general features of super:

• Fully automated updates and upgrades for both Intel and Apple Silicon Macs
• Customizable dialogs and notifications
• Variety of deferment and deadline options
• Extensive validation and logging

Major changes were part of super v3, released in June 2023:

• Full support for the latest workflows, including faster macOS upgrades and Rapid Security Release (RSR) updates
• Robust issue detection and mitigation
• Further dialog customization options
• Support for self-service workflows
• Customizable user authentication dialogs

The default workflow of super includes checking, downloading and preparing for macOS updates, as well as prompting the user for a restart or enforcing one if necessary. After post-installation startup, all available non-macOS updates are installed, and Jamf Pro inventory and check-in Policies are verified.

There are also several additional deferral and deadline options available to control the timelines for updates and upgrades. Dialog boxes presented to users can also be fully customised with text, markup, HTML, image or video.

Deploying super via Jamf Pro

Getting super deployed via Jamf Pro is simple: the script can be added in Jamf Pro policy as is, and up to 8 policy parameters can be set. Non-credential options are available via Config Profile. Super can restart periodically by itself or through Jamf Pro.

Some best practices to keep in mind when using super via Jamf Pro:

• If inventory is set to check for software updates through Jamf Pro, using inventory checks in Policy for super as well is not recommended
• It is possible to update super itself by re-running Policy
• If you only want to install super locally and not run the updates immediately, you can set up a skip updates option in the Policy script parameters
• You can clear old settings using a reset super option in the Policy script parameters
• For extension attribute scripts, check out the super wiki in GitHub

Coming soon: super version 4

Super has been improved for style and clarity in its new version, adding a more reliable, “always on” LaunchDaemon. The Beta version is already available, with the full release expected later this year.

For more information and to get started with super, visit https://github.com/Macjutsu/super/wiki.