Mac OS X silent software updates on a schedule w/ forced reboots if necessary

Question

I am in charge of about 40 Mac OS X computers on a predominantly PC network. The systems are running about an equal mix of Mac OS X 10.5 and 10.6.

We are instituting a new policy of forcing OS and software patches on all machines on a weekly schedule. We have some system management software in place that makes this pretty easy for the PCs, but I'm a little at a loss for a great solution on the Macs. Here is what I want to happen:

Every Friday at something like 9PM, all Macs should go out to Apple's software update server, download every patch, and reboot if necessary. This should happen automatically and on a schedule without any user or administrator interaction.

We don't have a Mac OS X Server, and purchasing one probably won't be an option for some time. I do however have the latest version of Apple Remote Desktop.

Any help would be appreciated.

Answer 1

Scott's answer is essentially correct, but a better method would be the following command (see the softwareupdate man page for full details):

/usr/sbin/softwareupdate --install --all --schedule off && /sbin/reboot

The addition of --schedule off will prevent the machine from checking & notifying the user of new updates the rest of the time. && /sbin/reboot will restart the machine if softwareupdate finished without error.

Also, I'd highly suggest that this be run from launchd for the sole reason that if the machine is asleep at the time it's supposed to fire, it'll be run as soon as the machine is woken up. It still won't fire off the job if the machine was off, but it's at least a little more intelligent than cron.

An example launchd plist file is as follows (see the launchd.plist man page for further details) and would need to be saved in /Library/LaunchDaemons/ as something like tld.domain.asu_reboot.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC -//Apple Computer//DTD PLIST 1.0//EN http://www.apple.com/DTDs/PropertyList-1.0.dtd >
<plist version="1.0">
    <dict>
        <key>Label</key>
        <string>tld.domain.softwareupdate</string>
        <key>ProgramArguments</key>
        <array>
            <string>/usr/local/sbin/asu_reboot</string>
        </array>
        <key>StartCalendarInterval</key>
        <dict>
            <key>Hour</key>
            <integer>21</integer>
            <key>Minute</key>
            <integer>0</integer>
        </dict>
    </dict>
</plist>

And the command would be put into a bash script in /usr/local/sbin/asu_reboot (Apple Software Update Reboot) called by the above launchd plist, like so:

#!/bin/bash
/usr/sbin/softwareupdate --install --all --schedule off && /sbin/reboot

With those two items in place (the bash script and the launchd plist), you would run the following command to load the job (or reboot the machine and it'd load automatically):

sudo launchctl load -w /Library/LaunchDaemons/tld.domain.asu_reboot.plist

Answer 2

Unless you get into something like Puppet then I think you're out of luck until you can buy a copy of OSX Server sorry. That said when you do get it you'll love it, it'll do just what you want.

Answer 3

You can add a cron entry to the root user's crontab that will do this. The entry would be something like:

0 19 * * 5 /usr/bin/softwareupdate --install --all

In order to edit the root user's crontab you will need to run the following command: sudo crontab -e

I'm not 100% of this solution because we use RADMIND to manage our patches and this concept scares me a little.