MAC-001 · Script

Software Update Report and Install

Lists pending macOS software updates and, in install mode, installs the ones that do not need a restart. Never installs a major macOS upgrade.

What it does

On Apple silicon, macOS only allows restart-required updates to be installed by a signed-in user or by MDM (DDM software update enforcement). This script reports them so your MDM can handle them.

Requirements

macOS 12 or later, run as root (MDM or RMM default). No prompts.

How to run it

• Run as: root (sudo in Terminal, or your MDM default)
• Run from: any MDM or RMM, a LaunchDaemon, or Terminal with sudo
• Script type: shell script (bash)
• User interaction: none; the script never prompts
• Timeout: 10 minutes (longer for app or update installs)

Settings

Exit codes

• 0 = No updates pending, or all selected updates installed
• 1 = Updates still pending (restart-required or failed)
• 2 = Script error

Testing steps

1. Run it first with the mode set to report on one test device. Nothing is changed in that mode.
2. Read the log and confirm the planned changes are what you expect.
3. Run your chosen settings on the same test target and confirm the result.
4. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
5. Roll out to a small group next, then everyone.

Rollback steps

Report mode changes nothing. Installed macOS updates cannot be uninstalled, so test on one Mac first.

Version and change log