I've got a Mac Mini Server running Lion Server. Right now, it is serving the Netboot and DHCP services. I'd like to set it up as a Software Update server so Mac users in my office can run their software updates more quickly.

This is the only Mac server in the office. All of our other servers are all Windows based. Most of the machines (Macs included) are joined to our Windows domain. All the Mac users in the office use portable MacBooks Pro that go home with them at the end of the day. They need to still be able to run use the Apple Software Update server when not in the office.

I'm looking for a way to have these Macs only use the Software Update server on my Mac Mini Server when in the office and for it to default to the Apple Software Update server when they're not in the office.

I found this, but it does not run on Lion.

Is this possible?

  • 1
    I'll see if I can test this today. My hope is that clients fall back to the apple default server when the custom site is not reachable. In that case, you would make sure your local server update DNS is not reachable / advertised when out of the office.
    – bmike
    Commented Feb 22, 2012 at 16:44
  • Ok. I do know that when you configure the SW Update service through Workgroup Manager, it still tries to contact the SW Update server set through Workgroup Manager even if you're not on that network.
    – Matt Love
    Commented Feb 22, 2012 at 16:58

4 Answers 4


There is a way to do this, but it involves fiddling with DNS to make a 'transparent' software update server. When clients are on your network, their requests to "Apple's" SWU servers go to yours, without any modification of client settings, it truly is transparent.

Check this article out. It's a little old, but this is the general idea that you want to be going with.

In your internal DNS set swquery.apple.com, swcdn.apple.com, and swscan.apple.com as CNAMEs for the server running SUS.

  • Would this still work if the Mac Mini Server is not the primary DNS server on the network, or would I have to add the IP of the Mac Mini server to the DNS settings on each client machine?
    – Matt Love
    Commented Feb 22, 2012 at 17:49
  • If you already have an internal DNS server that all your clients use, you need to make changes to the DNS records on that server. The whole idea is that you avoid making changes per client by making changes to a DNS server they all query.
    – macaco
    Commented Feb 22, 2012 at 20:42
  • So, just to be clear, all I would need to do is set up a forward on the primary DNS server for any incoming traffic going to swscan.apple.com to forward to myserver.local:8088, right?
    – Matt Love
    Commented Feb 22, 2012 at 20:46
  • Pretty much. Your clients are going to go to the DNS asking for the IP address of the Apple SU servers and you're gonna lie and give them the IP of your local SU server. It's important that your clients are configured to ask your local DNS before any others (this is usually the case), otherwise they may get handed the actual IP for Apple SU from another (more honest) DNS server. Outside of your network, your DNS isn't gonna be available - and they're gonna get handed Apple's IP as per usual.
    – macaco
    Commented Feb 22, 2012 at 20:55
  • That shouldn't be a problem. Our DHCP server is set to provide our DNS server as the primary DNS server. Thanks for the help! As soon as I get all the many GBs of software updates downloaded, I'll get this set up.
    – Matt Love
    Commented Feb 22, 2012 at 21:01

You could also script a defaults write com.apple.SoftwareUpdate CatalogURL triggered by a network change, such as grepping for ifconfig or scutil's State:/Network/Interface/en0/IPv4. Probably easy to do with Lingon etc as well.

  • I was trying to recall some software that was designed to coordinate changes based on detected changes in location. I like your scutil suggestion to change something like this framework. Also, oomphalot.com/sidekick and the now unsupported symonds.id.au/marcopolo might work well in place of a hand-rolled script.
    – bmike
    Commented Feb 22, 2012 at 18:06
  • 1
    I've been using ControlPlane to switch locations between work and home for a few months now - works really well and actively under development. Tons of configurable triggers, could also easily be set to run a script based on network changes.
    – da4
    Commented Feb 22, 2012 at 18:25
  • It seems to me that even with the default change the mac tries to connect to the default apple software servers when the one configured is not available... I am not sure though.
    – Coyote
    Commented May 30, 2012 at 22:17

I have found a link that might be useful to some. There seems to be a workaround for 10.7 server to make the SUS Transparent.

We were sticking to 10.6 because we hadn't found a solution that allowed us to upgrade to 10.7 and keep our SUS server working transparently. Well with this little guide maybe we will be able to!

I haven't tried it yet but I will soon: http://sites.google.com/site/stupidmactricks/home/transparentsoftwareupdateserverusingmacosxlionserver107


Profile manager can set this, and if you don't want to use that then a) why bother with a software update server at all and b) the config files are in /etc/swupd.

  • 1
    For anything more than a handful of Macs on the same network, hosting your own SUS dramatically saves on bandwidth - and can enable much finer control of deployed updates, increasing consistency. For example, perhaps the OP needs to test an internal website against some new release of Safari before allowing it to be deployed.
    – da4
    Commented Feb 22, 2012 at 17:43
  • 1
    This seems more of a "don't do what you ask" than an actual answer how to accomplish what is asked. Does this actually allow one setting to work internally and externally or does it need additional tweaking to coordinate these /etc files changing?
    – bmike
    Commented Feb 22, 2012 at 18:02
  • One of the key characteristics of Mac OS X Server is the device manager and assigning profiles and configuration options to do what is being asked. Failing that you can use an alternate method by managing options in the files in /etc/ with something like pymacadmin.
    – incumbent
    Commented Aug 28, 2012 at 2:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .