Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am in charge of about 40 Mac OS X computers on a predominantly PC network. The systems are running about an equal mix of Mac OS X 10.5 and 10.6.

We are instituting a new policy of forcing OS and software patches on all machines on a weekly schedule. We have some system management software in place that makes this pretty easy for the PCs, but I'm a little at a loss for a great solution on the Macs. Here is what I want to happen:

Every Friday at something like 9PM, all Macs should go out to Apple's software update server, download every patch, and reboot if necessary. This should happen automatically and on a schedule without any user or administrator interaction.

We don't have a Mac OS X Server, and purchasing one probably won't be an option for some time. I do however have the latest version of Apple Remote Desktop.

Any help would be appreciated.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Scott's answer is essentially correct, but a better method would be the following command (see the softwareupdate man page for full details):

/usr/sbin/softwareupdate --install --all --schedule off && /sbin/reboot

The addition of --schedule off will prevent the machine from checking & notifying the user of new updates the rest of the time. && /sbin/reboot will restart the machine if softwareupdate finished without error.

Also, I'd highly suggest that this be run from launchd for the sole reason that if the machine is asleep at the time it's supposed to fire, it'll be run as soon as the machine is woken up. It still won't fire off the job if the machine was off, but it's at least a little more intelligent than cron.

An example launchd plist file is as follows (see the launchd.plist man page for further details) and would need to be saved in /Library/LaunchDaemons/ as something like tld.domain.asu_reboot.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC -//Apple Computer//DTD PLIST 1.0//EN http://www.apple.com/DTDs/PropertyList-1.0.dtd >
<plist version="1.0">
    <dict>
        <key>Label</key>
        <string>tld.domain.softwareupdate</string>
        <key>ProgramArguments</key>
        <array>
            <string>/usr/local/sbin/asu_reboot</string>
        </array>
        <key>StartCalendarInterval</key>
        <dict>
            <key>Hour</key>
            <integer>21</integer>
            <key>Minute</key>
            <integer>0</integer>
        </dict>
    </dict>
</plist>

And the command would be put into a bash script in /usr/local/sbin/asu_reboot (Apple Software Update Reboot) called by the above launchd plist, like so:

#!/bin/bash
/usr/sbin/softwareupdate --install --all --schedule off && /sbin/reboot

With those two items in place (the bash script and the launchd plist), you would run the following command to load the job (or reboot the machine and it'd load automatically):

sudo launchctl load -w /Library/LaunchDaemons/tld.domain.asu_reboot.plist
share|improve this answer
1  
I'd use /sbin/shutdown -r now instead of /sbin/reboot (it seems to do a slightly more orderly shutdown of system daemons before rebooting), and maybe even add something to the script to try to close down UI sessions first. Also, rebooting isn't always needed -- I think you can test this (before doing the update itself) with if /usr/sbin/softwareupdate --list | grep -q " \\[restart\\]"; then ... –  Gordon Davisson Oct 14 '10 at 17:49
    
Agreed. In fact, I believe the result of usr/sbin/softwareupdate --install --all --schedule off will tell you if a reboot is necessary, so you could save an additional step. –  morgant Oct 14 '10 at 21:01

Unless you get into something like Puppet then I think you're out of luck until you can buy a copy of OSX Server sorry. That said when you do get it you'll love it, it'll do just what you want.

share|improve this answer

You can add a cron entry to the root user's crontab that will do this. The entry would be something like:

0 19 * * 5 /usr/bin/softwareupdate --install --all

In order to edit the root user's crontab you will need to run the following command: sudo crontab -e

I'm not 100% of this solution because we use RADMIND to manage our patches and this concept scares me a little.

share|improve this answer
    
Interesting, will that download, apply and reboot in one go? –  Chopper3 Oct 14 '10 at 15:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.