Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Xserve G5 running Mac OS X Server 10.5.8 configured as an Open Directory master. I have also enabled and configured Software Update service on the machine. The SUS is configured to serve Tiger, Leopard and Snow Leopard clients (see

The clients bound to the OD are a variety of Mac's running OS X 10.4, 10.5 or 10.6. In Workgroup Manager, I have created 3 machine groups for each client OS. Each group is configured with a custom SUS URL, and the managed client computers are members accordingly (see

My problem is that the server pushes the SUS settings to some of the client machines, but not all. When I first configured all this stuff on the server (a few weeks ago) I was closely monitoring a few of the client machines to confirm that they received the custom settings. I noticed that some of the clients (10.4/5/6 alike) seemed to get the settings immediately, others didn't show the new settings until after a reboot. As I said, results are mixed across OS's, but some clients will not "sync" at all.

My immediate thought was to unbind/rebind the problematic machines. I did this on several client computers with no success.

For example, today I was working on one of the Tiger clients. I noticed it was not pointed at my local SUS, so I checked the OD binding; it was fine. Just to be sure I unbound the machine. Next, I checked WM and confirmed the computer record was gone. I noticed the machine group still had a residual (broken?) member from the unbound client; I manually removed this. Finally, I re-bound the client to OD and re-added the machine to it's correct group in WM. Unfortunately, the client still pings apple's SUS for updates. Just to play it safe I rebooted the client, but to no avail, it will not see my local SUS.

To confirm that there is nothing wrong with the server, or the client's connection to it, forcefully pointed the machine at my SUS:

sudo defaults write /Library/Preferences/ CatalogURL "$LOCAL_SUS_URL"

and the machine successfully updated off my local server.

Great, successful updates, but problem not solved.

I've done exhaustive reading on (not saying I read everything, I'm just saying I have read a lot) without a good answer. The discouraging thing is that a lot of OD problems I've read about only result in the sysadmin completely reinstalling the server, or OD, or some other similarly heavy-handed operation. At this point, I am not willing to go that route. I still have hope that I can find the reason for this flaky behavior.

If anyone can point me in a helpful direction it would be much appreciated.


Indeed, some files are being pushed to the client:

# from client machine:
$ sudo find /Library -type f -name 
/Library/Managed Preferences/
/Library/Managed Preferences/username/

A few weeks ago, prior to my (previously mentioned) modifications, the SUS was still running "stock". Which meant it could not serve SL (10.6) machines. At that time, the Software Update settings were setup in WM under User Groups. This didn't make any sense because some users work on multiple machines with different OS's.

Before creating Machine Groups in WM, I deleted all the SU settings from the User Group Preferences. This just makes the whole thing more confusing, because when I see a file here:

/Library/Managed Preferences/username/

I assume it's still remaining from the "old" settings, because I wouldn't think a Machine Setting belongs there.

Despite all the hanging around under the Managed Preferences, why does the client machine still call home to Apple and not my SUS?

# on client machine:
$ date
Tue Jan 25 17:01:46 EST 2011
$ softwareupdate --list
Software Update Tool
Copyright 2002-2005 Apple

No new software available.

switch terminals...

# on server:
$ tail -n1 /var/log/swupd/swupd_access_log
10.x.x.x - - [25/Jan/2011:15:54:29 -0500] XXXX POST "/cgi-bin/SoftwareUpdateServerStats" 200 13 ...

Notice the date of the client softwareupdate and the latest access to the SUS server; the server never heard a peep from that client.

share|improve this question

is the managed preference file actually pushed from the server? It should be located at

/Library/Managed Preferences/_username_/
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.