Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Updated title for Yosemite / 10.10, the issue remains the same.


This is mostly a moot point for our organization as we're starting to let more and more people upgrade to Mavericks as they desire, however I suspect 10.10 will have similar promotion within the App store once it's released so I'm asking anyway.

For the past few months we've pushed our users to not upgrade to Mavericks which has for the most part been effective with only 3 or 4 (out of almost 200) installing it without checking with us first. Over the past few weeks though I've seen that number rise dramatically though as people install it thinking it's just a software update. We've trained our users to install Apple software updates whenever they are prompted, thanks in part to us blocking and releasing updates through our internal software update server, so we may be partially to blame for this.

The problem as I see it is that Apple is pushing Mavericks using advertising in the Software Update section of the Mac App Store. End users see this (see below) and think "Oh, this is just another update, they must've cleared it for us to use", which isn't necessarily the case.

Mavericks in App Store's Software Update section

Have any other Mac admins successfully combatted this, either through blocking it from appearing in the Software Update section or by re-training their end users? I've had the thought about killing the path to Apple (swcdn.apple.com) but white listing our Mac Pro server to still allow access for our SUS. I don't like this idea though because we think this would also affect purchasing new apps on both Mac and iOS for the rest of the devices.

share|improve this question
    
So, your users are admins? That's crazy. My advice: take away their admin privileges, and use Munki to allow them to install all Apple and third party software. code.google.com/p/munki –  Jay Thompson Jan 27 at 17:45
    
@JayThompson - It would be ideal to do just that, however a large portion of our staff are frequently out of the office. It's not uncommon for an employee to be away for a month or two (or longer) at a time. If this wasn't the case then I would absolutely force them to be standard users, as it sits though it creates much extra strain on support if they require admin access, which is somewhat frequent, while traveling. –  Mr Rabbit Jan 31 at 17:09

1 Answer 1

Yes. I have had pretty good success with this method I describe below.


Disable Mac App Store

The App Store is simply not suitable for administration. Barely a quasi-package manager, it is not nearly as useful or reliable as real package managers like pkgsrc, FreeBSD ports, aptitude, RPM, macports or even softwareupdate. In my experience, it is unpredictable and a beard for commercial developers to hock their wares. So there is really only one rational and responsible way, as a competent administrator, to work with App Store:

 sudo launchctl unload -w /System/Library/LaunchAgents/com.apple.store_helper.plist

 sudo launchctl unload -w /System/Library/LaunchAgents/com.apple.storeagent.plist

 sudo mkdir /System/Library/LaunchAgents\ \(disabled\)/

 sudo mv /System/Library/LaunchAgents/com.apple.store* /System/Library/LaunchAgents\ \(disabled\)/

And just put it out of your mind, it won't trouble you any longer. ;-)


Use Apple Remote Desktop Admin

Use ARD instead, though not a package manager, it manages packages, installations, updates, and upgrades, it will do what you want, save you time, and will not let you down:

For Apple Remote Desktop 3, for 10.9:

Check out the admin guide first to convince yourself that this is the way to go:

curl -Ok http://images.apple.com/ca/fr/remotedesktop/pdf/ARD3_AdminGuide.pdf

    open ARD3_AdminGuide.pdf

Then install:

curl -Ok http://supportdownload.apple.com/download.info.apple.com/Apple_Support_Area/Apple_Software_Updates/Mac_OS_X/downloads/031-2845.20140313.rerft/RemoteDesktopAdmin372.dmg

hdiutil attach -quiet -noverify -nobrowse -noautoopen RemoteDesktopAdmin372.dmg

sudo installer -pkg /Volumes/Apple\ Remote\ Desktop\ 3.7.2\ Admin\ Update/RemoteDesktopAdmin372.pkg -target /

but that might throw a funny error if not running 10.9, or if no previous version of ARD is installed, and if it does, try:

pkgutil --expand /Volumes/Apple\ Remote\ Desktop\ 3.7.2\ Admin\ Update/RemoteDesktopAdmin372.pkg ARDexpanded/

or to equal effect (either/or here, don't need to use both pkgutil and xar... I'm just being thorough):

mkdir ARDexpanded

cd ARDexpanded

xar -xf /Volumes/Apple\ Remote\ Desktop\ 3.7.2\ Admin\ Update/RemoteDesktopAdmin372.pkg

And we no longer need the disk image attached, so eject it:

hdiutil detach -quiet /Volumes/Apple\ Remote\ Desktop\ 3.7.2\ Admin\ Update/

And now what you'll see if you

cd ARDexpanded/RemoteDesktopAdmin372.pkg/

ls

is

    Bom         PackageInfo Payload     Scripts

What's in the Payload file, which is a cpio archive compressed with gzip, is what you're after. So with a few piped commands we can get to the app bundle:

cat Payload | gzip -d - | cpio -id

ls

returns:

    Applications Bom          Library      PackageInfo  Payload      Scripts

And you're nearly done.

cp -R Applications/Remote\ Desktop.app /Applications/

Now you have installed Apple Remote Desktop Admin 3.7.2

So all that's left to do is purchase your license:

open http://store.apple.com/us_smb_78313/product/D6020Z/A/apple-remote-desktop-3-volume-licenses-20-seats-price-is-per-seat

Launch /Applications/Remote\ Desktop.app and serialize. And get some work done.


For 10.6 Snow Leopard, you'll need a slightly earlier version of ARD:

curl -Ok http://images.apple.com/ca/fr/remotedesktop/pdf/ARD3_AdminGuide.pdf

curl -Ok http://supportdownload.apple.com/download.info.apple.com/Apple_Support_Area/Apple_Software_Updates/Mac_OS_X/downloads/041-6789.20120917.xD6TR/RemoteDesktopAdmin353.dmg

hdiutil attach -quiet -noverify -nobrowse -noautoopen RemoteDesktopAdmin353.dmg

sudo installer -pkg /Volumes/Apple\ Remote\ Desktop\ 3.5.3\ Admin\ Update/RemoteDesktopAdmin353.pkg -target /

and if it throws back at you this:

    installer: Cannot install on volume / because it is disabled.
    installer: This update could not find Remote Desktop on this volume.

then try:

pkgutil --expand /Volumes/Apple\ Remote\ Desktop\ 3.5.3\ Admin\ Update/RemoteDesktopAdmin353.pkg ARD353

hdiutil detach -quiet /Volumes/Apple\ Remote\ Desktop\ 3.5.3\ Admin\ Update

drill down to the Payload:

    cd ARD353/RemoteDesktopAdmin353.pkg/

    ls

returns:

    Bom         PackageInfo Payload     Scripts

So run:

cat Payload | gzip -d - | cpio -id

ls

returns:

Applications Bom          Library      PackageInfo  Payload      Scripts

And you're nearly done:

cp -R Applications/Remote\ Desktop.app /Applications/

purchase your license:

open http://store.apple.com/us_smb_78313/product/D6020Z/A/apple-remote-desktop-3-volume-licenses-20-seats-price-is-per-seat

Launch /Applications/Remote\ Desktop.app and serialize. And get something done.


Remove users' admin rights

Also, you may want to deeply consider removing admin rights for your users; although this will create more work for you if your users often need to authenticate with admin passwords, it may also help prevent "bad things." And if you have ARD installed, you can connect to their logins from your desk to authenticate for them remotely.

share|improve this answer
    
Thanks for the reply! I'm well versed though and quite experienced in pushing out updates both through scripts and ARD from our local update servers. Our client Macs are already set to pull either from our internal SUS, the caching server, or if offsite to pull from Apple. So this actually works quite well for us and isn't an issue. The issue that I tried to lay out is restricting a new OS from showing up alongside software updates, which leads to confusion and inadvertent installations by our end users. –  Mr Rabbit May 12 at 15:05
    
Killing the Mac App Store completely out of the question as we have an app available in it, there's no way I could convince my boss to remove the delivery method for one of the few things we actually sell. I also gave some of our reasoning for allowing the end users to have admin access. I whole heartedly agree that having standard users would make some things easier but thanks to my experience with other situations I know this would dramatically increase my workload. This situation is one of 2 or 3 that has caused any problems as a result of admin access, it's usually not a big deal for us –  Mr Rabbit May 12 at 15:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.