Tutorial

In enterprise environments, controlling when and how macOS updates are installed is crucial for maintaining system stability and ensuring compatibility with business applications. This tutorial shows how to disable automatic macOS updates using shell scripts.

Understanding macOS Update Settings

macOS has two main automatic update behaviors:

• Automatic Download: Downloads updates in the background
• Automatic Check: Periodically checks Apple's servers for new updates

Both can be controlled via the com.apple.SoftwareUpdate preference domain.

Basic Scripts

Disable Automatic Download

#!/bin/bash
defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -boolean false

Disable Automatic Check

#!/bin/bash
defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -boolean false

Enterprise Deployment Script

For large-scale deployment across your Roundfleet:

#!/bin/bash

# Disable Automatic macOS Updates - Enterprise Script
# Compatible with macOS 10.14+

# Function to log messages
log_message() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a /var/log/macos_update_config.log
}

# Function to get current user
get_current_user() {
    stat -f "%Su" /dev/console
}

# Main configuration function
configure_updates() {
    local current_user
    current_user=$(get_current_user)
    
    log_message "Starting macOS update configuration for user: $current_user"
    
    # Disable automatic download
    if defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -boolean false; then
        log_message "✓ Automatic download disabled successfully"
    else
        log_message "✗ Failed to disable automatic download"
        return 1
    fi
    
    # Disable automatic check
    if defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -boolean false; then
        log_message "✓ Automatic check disabled successfully"
    else
        log_message "✗ Failed to disable automatic check"
        return 1
    fi
    
    # Disable automatic installation (additional security)
    if defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -boolean false; then
        log_message "✓ Automatic installation disabled successfully"
    else
        log_message "✗ Failed to disable automatic installation"
    fi
    
    # Kill Software Update preferences to force reload
    killall -HUP cfprefsd 2>/dev/null || true
    
    log_message "macOS update configuration completed"
    return 0
}

# Verification function
verify_configuration() {
    local download_status check_status install_status
    
    download_status=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload 2>/dev/null || echo "not set")
    check_status=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled 2>/dev/null || echo "not set")
    install_status=$(defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates 2>/dev/null || echo "not set")
    
    log_message "Configuration verification:"
    log_message "  Automatic Download: $download_status"
    log_message "  Automatic Check: $check_status"
    log_message "  Automatic Install: $install_status"
}

# Execute main function
if configure_updates; then
    verify_configuration
    log_message "Script executed successfully"
    exit 0
else
    log_message "Script execution failed"
    exit 1
fi

Verification Script

Check current update settings:

#!/bin/bash

echo "=== macOS Update Settings Status ==="
echo "Automatic Download: $(defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload 2>/dev/null || echo 'Not configured')"
echo "Automatic Check: $(defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled 2>/dev/null || echo 'Not configured')"
echo "Automatic Install: $(defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates 2>/dev/null || echo 'Not configured')"

Re-enabling Updates

To restore automatic updates:

#!/bin/bash

# Re-enable automatic download
defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticDownload -boolean true

# Re-enable automatic check
defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -boolean true

# Re-enable automatic installation
defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -boolean true

echo "Automatic updates re-enabled"

Troubleshooting

Important Notes

• Users with admin privileges can manually change these settings
• The System Preferences/Settings app may need to be restarted to reflect changes
• Consider using Configuration Profiles for stricter enforcement
• Test on a small group before enterprise-wide deployment

Configuration Profile Alternative

For stricter control, consider deploying a Configuration Profile instead:

<key>AutomaticCheckEnabled</key>
<false/>
<key>AutomaticDownload</key>
<false/>
<key>AutomaticallyInstallMacOSUpdates</key>
<false/>