Fileset to block Apple Install macOS applications

Description

As described, this only blocks macOS Installer Applications.  Preventing users from using Software Updates can only be achieved with Defer Apple OS Updates and you should consider this because Software Update is capable of running the upgrade even with this solution in place.

Apple automatically installs the latest installer application on devices, allowing users to upgrade to the next major release of macOS.  The following provides a method to prevent users from running the application, ensuring administrators have the required time to prepare the business.

The provided Fileset includes an unaltered version of the Open Source Software Pashua, which is licensed under the 3-Clause BSD License.

The attached Fileset uses Pashua configuration files such as warning_en.txt and warning_de.txt to control the warning window text and placement. If the warning title and message overlap on newer macOS releases, adjust those Pashua layout values in the Fileset and test on the target macOS version before redeploying.

Information

The attached Fileset prompts users with a message, including alternate languages.  There is also allowance for control over which versions of macOS Installers are blocked.  The only requirements are the following Filesets:

• mac0S - Block macOS Installer Pashua Daemon.fileset.zip

On macOS 13 or later, deploy the following Managed Login Items profile to the same Macs before installing the blocker Fileset. The supplied profile already contains the Service Management rules for both the blocker and its user-visible notifier; a second Managed Login Items profile is not required for these labels.

• Managed Login Items profile - blocker and notifier

The blocker Fileset includes a requirement script that checks for the supplied profile on macOS 13 or later before the blocker is installed. Import the profile Fileset, deploy it through MDM, and confirm that it is installed on the target Mac before deploying the blocker. It imports as Profile - com.filewave.blockmacosinstall.notifier. If you replace it with a separately created profile, update the requirement script configuration: it checks the supplied profile identifier, not just whether equivalent rules exist. Pass the replacement profile’s PayloadIdentifier as the script argument and retain the environment variable all_or_one=one for this single-profile check. Do not leave the identifier argument or environment variable blank.

Optionally the following Custom Field may be used to monitor the quantity of times users attempt to upgrade devices:

macOSAppInstallerBlockAttempts.customfields.zip

The above installs launchd services.  Disassociation of the Fileset will unload these services as well as remove all files.

What does the included profile do? The download previously labeled “Profile - Block Notifications” is a Managed Login Items / Service Management profile, not an application Notifications profile. Its com.apple.servicemanagement payload contains exact Label rules for com.filewave.blockmacosinstall (the blocker LaunchDaemon) and com.filewave.blockmacosinstall.notifier (the notifier LaunchAgent). These rules manage and approve the matching background items on macOS 13 or later. You do not need to create another profile for those same labels.

Notifications are different: An application Notifications payload controls notification permissions and presentation. The attached profile has no com.apple.notificationsettings payload. The blocker’s user-facing warning window is displayed by Pashua and customized using the message files described below.

After deployment, confirm the profile is installed and check that macOS identifies the matching background items as managed. If a user can still disable an item, verify the installed profile and the item’s actual launchd label rather than adding a duplicate profile. See Apple’s Manage login items and background tasks on Mac for matching rules and diagnostics.

Directions

The Fileset is currently configured to block Install macOS Ventura.app and later installer app versions whose bundle identifiers match the script’s macOS installer filter. Beta installers are not necessarily covered by that filter. Version control is managed by the plist file in /usr/local/etc/block_macos_updates/:

com.filewave.blockmacosinstaller_user.plist

Contents of the file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>MinimumBlockedVersion</key>
<integer>18</integer>
</dict>
</plist>

Version of App to Block

Edit the file as required for the following:

• Key - MinimumBlockedVersion
• Value - Integer

Set MinimumBlockedVersion to the major version of the installer app's CFBundleShortVersionString. This is the installer app version, not the Darwin/kernel version and not always the same as Apple's marketing macOS version. For example, Tahoe is marketed as macOS 26, but the Tahoe installer app version is 21.x, following Sequoia installer apps at 20.x.

For the production macOS 27 Golden Gate installer (build 26A428), the actual app CFBundleShortVersionString is 22.0.02 (CFBundleVersion 22002). Set MinimumBlockedVersion to 22, not 27, to target Golden Gate and later matching installer app versions. Its bundle identifier, com.apple.InstallAssistant.macOSGoldenGate, passes the current Fileset’s ^com\.apple\.InstallAssistant\.macOS filter.

The inspected Golden Gate Beta 8 installer (build 26A5425a, app version 22.0.03) instead uses com.apple.InstallAssistant.Seed.macOS27Seed. It fails the bundle-identifier filter before the version comparison, so changing MinimumBlockedVersion alone does not block that Seed installer. The production check verified package metadata and the current script predicate; it was not an end-to-end blocking test. Pilot the Fileset on your target Macs before wider deployment.

Example alternatives:

• 22 - Block Golden Gate and above (matching installer bundle identifiers)
• 21 - Block Tahoe and above
• 20 - Block Sequoia and above
• 19 - Block Sonoma and above
• 18 - Block Ventura and above
• 17 - Block Monterey and above
• 15 - Block Catalina and above
• 14 - Block Mojave and above

The script defines a version to block (and versions above) in the case that no plist file is found.  This is set to 15, since this should never be the case and is a capture to prevent unwanted updates in this unexpected instance.

Message Localisation

When the installed service blocks the App, a message is reported to the user.  Examples have been provided for English and German.

The language is determined by the first two characters from the following command:

$ defaults read -g AppleLanguages | awk -F "\"" '/\"/ {print $2; exit}'
en-GB

As such en-GB, en-US, en-AU, etc will all result in an English version.

Language template files are stored in the path:

/usr/local/etc/block_macos_updates/

English and German respectively:

• warning_en.txt
• warning_de.txt

Copy and edit the files appropriately for additional languages.

Example to add French

User has French language set:

$ defaults read -g AppleLanguages | awk -F "\"" '/\"/ {print $2; exit}'
fr-FR

Based upon this, create a copy warning file (note the suffix '_fr'):

• warning_fr.txt

Edit '*.title' and default message 'txt1.default' appropriately:

# Set window title
*.title = Installation bloquée
 
# Introductory text
txt.type = text
txt.default = macOS Installer Application
txt.height = 100
txt.width = 310
txt.x = 100
txt.y = 120
 
txt1.type = text
txt1.default = Cette version de macOS n'est pas prête pour l'environnement de production. Veuillez contacter le service informatique si nécessaire.
txt1.height = 100
txt1.width = 310
txt1.x = 100
txt1.y = 50
 
img.type = image
img.x = 20
img.y = 70
img.maxwidth = 64
img.path = /usr/local/etc/FileWave_Icon.png

Text content will impact the view.  Consider changing height, x and y values if the view does not appear as intended.

Upload and replace the 'img.path' as your own company logo for customisation.

Logging

The launchd scripts have additional logging which will be available in Apple's Console (Debug level Info).  For example: