Update: Apparently, a real fix for this is on the way.
Acknowledgements: thanks to elios and bochoven on MacAdmins Slack for figuring out what was going on.
If the icons in your Munki repo looked fine on your 10.12 and 10.11 clients, and then a few of them suddenly look sort of faded (for example, Word and Excel in this screenshot) in 10.13 clients, it's apparently because of a change in the way 10.13's Safari webkit displays .png files missing the ColorSync profile in the Get Info context menu (you'll still see the ColorSync profile if you open the .png with the ColorSync Utility).
The simple fix is to do the following:
- Mount the Munki repo share using a Mac running macOS 10.13.
- Delete the offending icons from /PATH/TO/MUNKI/REPO/icons/
- Regenerate new icons with
Note: Icons generated using MunkiAdmin or sips will be fine, too, even if generated using a machine running macOS 10.12.
This is a sequel to Keeping up to date using Munki without bothering users, which discussed a few approaches to not bothering users with Managed Software Center updates.
I'd tried controlling it with rescheduling the launch daemon, which works well for desktops, which are plugged in and can be scheduled to be on at specific times—not so great for laptops which can be sleeping at random times during the day.
I'd also tried setting the DaysBetweenNotifications client preference (full list of preferences on the Munki wiki), but that was still giving mixed results.
Special thanks to Ben Goodstein (on the Mac Admins Slack), who gave the suggestion of using the SuppressUserNotification preference on some kind of a schedule.
So right now I'm trying out (and I believe it should work), having a Munki nopkg manage that setting based on the time of day, day of week, and date of month (basically if it's toward the end of the month and not during the school day, I actually don't want notifications suppressed; otherwise, I always want them suppressed).
Here's my nopkg for SuppressUserNotification—feel free to tweak to suit the needs of your organization or school. I may also revise it based on my testing with users.
What's the issue?
If all your updates are up-to-date in Managed Software Center, when you select an optional install to install, it will install in the background and be ready to use almost immediately.
If, however, you have some pending updates that require a logout or reboot, your optional install (even an unattended install) won't install unless you install all those other updates, too.
What's the workaround?
The best workaround I've found for this is to use Managed Software Center to queue up the optional install. Once it's queued up, quit of Managed Software Center and then run
sudo /usr/local/munki/managedsoftwareupdate --auto
which is the same command that the background hourly checks runs. You won't get any visual feedback, but all the unattended install items will install, and then you can take care of the reboot/logout items at a more convenient time.
Why would you want an optional install to process without logout/reboot items, too?
While I generally agree with Greg Neagle's (who is the author and primary developer on Munki) carrot-stick approach to updates, there are some times when it's extremely frustrating to have to wait for those updates to apply just to get one piece of software.
Of course I want users installing updates, so I don't want them constantly ignoring updates and then installing unattended_installs indefinitely.
At the same time, I have two main objections to an unwavering, no-exceptions carrot-stick approach to updates in Managed Software Center:
- We want user buy-in. At least for our organization, Managed Software Center (Munki) is a relatively new thing. We want people to use it. If it looks as if it takes ten minutes to install Skype or Firefox, that doesn't make MSC look amazing to the user—it makes MSC look cumbersome.
- Updates can come at any time. Yes, we control when updates get deployed, but we recently had a situation in which we'd recently released a set of logout-required updates (no reason not to that we could predict), and then a user wanted to install PowerTeacher Gradebook (an unattended install). In this case, it's not carrot-stick at all. Even if the user had been keeping up with all her updates, the one we just released suddenly appeared, so she didn't have a chance earlier to install the updates. So, again, it's super awkward when you're standing next to a teacher and say, "Yeah, just install this through Managed Software Center. Oh, yeah, we have a bunch of updates that require a logout. This may take a while." And then what would otherwise be a 30-second installation turns into a five-minute thumb-twiddling session.
Eventually, we're hoping to leverage the force install after date feature in Munki. Even then, we would use it sparingly and give users at least two weeks to install updates, so this workaround would still come in handy.
I was having a weird issue with CrashPlan, in which Munki was blocking CrashPlan from uninstalling because CrashPlan.app was supposedly running (the actual app wasn't running‐just a CrashPlan-initiated launch daemon). Unfortunately, I didn't actually read the documentation on blocking applications, because there is, in fact, a different between not specifying a blocking application and specifying no blocking applications.
If you don't have blocking applications specified, Munki will still block anything in the installs list.
If, however, you have an empty blocking_applications array, nothing will block the uninstall.
If you've just installed Managed Software Center (you may have heard someone in the tech department call it Munki), you may not know how to use it. One major use for MSC is to install software.
Launch up Managed Software Center. You'll find it in your /Applications folder, but you can also keep it in your Dock for easy access.
You should see a list of approved and pre-packaged software. All the software you see listed you can install by simply clicking Install (no wizards to click through, no icons to drag, no serial numbers to enter).
In this example, we're installing PowerTeacher Gradebook. Notice how, after you click Install, MSC will already let you know the software is Downloading.
You don't have to monitor the progress of the download, but if you want to, you can click on the Updates tab at the top to see how the installation is going in the background.
P.S. Most software will just install, and that's it. For PowerTeacher Gradebook, you'll see a Gradebook First Run.app appear on your desktop once it's installed. Double-click that, and Gradebook will be fully initialized.