Whip up a quick smart group to check for machines that have installed today's #iamroot fix from Apple.
So… the last 24 hours have been pretty fun, right? You may have heard about some shenanigans involving blank passwords and the root account yesterday; Apple certainly did. And they fixed it today with an update available only to 10.13.1 High Sierra machines. If you manage your Macs with Jamf and want a quick smart group to see who has installed it, whip one up that looks for the receipt for the update. It's pretty easy.
That receipt name is com.apple.pkg.update.os.10.13.1Supplemental.17B1002.
Naturally this smart group won't be all that accurate until you give machines time to update inventory. If you're not super concerned with bandwidth you can find your inventory update policy and flush all logs so the next time a machines checks in it will run a fresh recon.
Worth noting, there are other ways to do this too. This is one quick way to build your smart group.
Update:
On November 30th, Apple pushed out a second security update to fix some issues their other security update caused. The macOS team at Apple is having a fun week I'm sure. This secondary update is being pushed automatically to 10.13 and 10.13.1 machines, and the receipt for the installer is com.apple.pkg.update.os.10.13.1Supplemental.17B1003. I'm not sure if there is a different installer for 10.13.0 so I'm unable to check for a receipt name for that. If someone knows if the update for 10.13 has a different receipt let me know in the comments and I can update this post.
Your smart group will want to be modified to include this second update as well.
I have yet to see a 10.13.0 machine install the update so I'm not sure if their updater has a different receipt, nor am I sure what OS build number a 10.13.0 machine will have after installing it. Feel free to comment below if you have that information.
Update 2:
It's being reported on Jamf Nation that the package receipt for 10.13.0 machines is com.apple.pkg.update.os.10.13Supplemental.17A501, which implies the build number after the installation is 17A501.
That receipt name is com.apple.pkg.update.os.10.13.1Supplemental.17B1002.
Naturally this smart group won't be all that accurate until you give machines time to update inventory. If you're not super concerned with bandwidth you can find your inventory update policy and flush all logs so the next time a machines checks in it will run a fresh recon.
Worth noting, there are other ways to do this too. This is one quick way to build your smart group.
Update:
On November 30th, Apple pushed out a second security update to fix some issues their other security update caused. The macOS team at Apple is having a fun week I'm sure. This secondary update is being pushed automatically to 10.13 and 10.13.1 machines, and the receipt for the installer is com.apple.pkg.update.os.10.13.1Supplemental.17B1003. I'm not sure if there is a different installer for 10.13.0 so I'm unable to check for a receipt name for that. If someone knows if the update for 10.13 has a different receipt let me know in the comments and I can update this post.
Your smart group will want to be modified to include this second update as well.
I have yet to see a 10.13.0 machine install the update so I'm not sure if their updater has a different receipt, nor am I sure what OS build number a 10.13.0 machine will have after installing it. Feel free to comment below if you have that information.
Update 2:
It's being reported on Jamf Nation that the package receipt for 10.13.0 machines is com.apple.pkg.update.os.10.13Supplemental.17A501, which implies the build number after the installation is 17A501.
Write a comment
Post a Comment