JAMF Nation, hosted by JAMF Software, is a dynamic and knowledgeable community of Apple-focused IT admins and Casper Suite users. Join us in person, in October, for the annual JAMF Nation User Conference (JNUC) to discover new and better ways to manage Apple devices.

CCT Badge CCA Badge
129

Software Update Server Updates automatically disabling

Posted: 10/16/15 at 11:42 AM by Matt.Ellis

I didn't have any luck on the apple forums. So im hoping to have more here.

I am currently setting up a Software Update server for my company and im having a strange issue. I enable all updates from 2103 - Current. They show as enabled and downloaded. But when i come in the next day all updates are disabled. has anyone ever seen this issue before?

System specs:
Mac Mini Late (2012)
OS X 10.10.5
Server app 5.0.4

Mac mini, OS X Yosemite (10.10.5), Server App 5.0.4

129
CCA Badge CSE Badge CMA Badge

Posted: 10/16/15 at 12:07 PM by gskibum

I didn't have any luck on the apple forums.

Join the club! :-)

Hopefully someone chimes in with an easier solution than mine.

For many years Software Update Server would frequently break on me on different servers at many different locations. When it would break I quit banging my head against the wall with trying to fix it and would just reset it back to default. 3-4 years ago it stopped breaking on me so I haven't had to reset to defaults in a long time. Now I don't remember how to reset it.

I tried to search for the procedure just now and was finding old info that may be outdated.

CCT Badge CCA Badge

Posted: 10/16/15 at 12:41 PM by Matt.Ellis

Dang seems like when they removed server admin, OS X server when to hell :( thanks for the reply though ill update this if i get anywhere.

CCA Badge CSE Badge CMA Badge

Posted: 10/16/15 at 4:08 PM by gskibum

Ha I just found this by modifying my keyword search a bit.
https://support.apple.com/en-us/HT200272

CCT Badge CCA Badge

Posted: 10/16/15 at 4:45 PM by Matt.Ellis

Isn't quite in keeping with my senario but ill give it a go this server isn't in production yet. thanks

CCA Badge CCE Badge CUG Badge

Posted: 10/17/15 at 10:48 AM by bentoms

@Matt.Ellis i wonder if it's an issue with the available space?

I've detailed what I saw when that was my issue here

CCA Badge CMA Badge

Posted: 10/19/15 at 9:47 AM by gshackney

Ill 2nd the available space piece,
I found that it suddenly stops download updates and then appears to not do anything else. But if you check the server logs for softwareupdateserver you will see messages for disk full (it usually saves a certain percentage of the drive for free space).

Gabe Shackney
Princeton Public Schools

CCT Badge CCA Badge

Posted: 10/23/15 at 6:23 PM by Matt.Ellis

In my case it shouldn't be a space issue. I have about 600gb available on the server. Ill double check when i get back into town just finished up my cca today :)

CCT Badge CCA Badge

Posted: 10/26/15 at 10:09 AM by Matt.Ellis

So i did verify it, i have 600gb of space still open, i can try upgrading to the newest Server App, and see if that helps? im also going to search thought the log today as @gshackney recommended

CCA Badge CMA Badge

Posted: 10/26/15 at 10:14 AM by gshackney

Also I've found that setting the server to store the data on a separate drive, aside from the boot drive, had issues. I eventually got this working, and I think the newest Server app helped this a bit.

Gabe Shackney
Princeton Public Schools

CCT Badge CCA Badge

Posted: 10/27/15 at 3:05 PM by Matt.Ellis

So everything is stored on one drive, i upgraded to 10.11.1 and updated the server app to 5.0.15, Enabled the updates i wanted. Was able to update my computer with them. a few hours later all show as disabled in server app.

Since this server isn't in production yet im half tempted to wipe the whole thing and start again maybe something got corrupted in an update.

CCA Badge CMA Badge

Posted: 10/29/15 at 1:20 PM by dgreening

I am seeing this as well - OS X 10.10.5 with Server 5.0.4 - updates saving to the standard place on the system volume. I have set the system volume reserve to 10%, and the permissions on the config files are good. I go in and enable updates (10.11 updates in this case) and a couple of hours later they are disabled again.

CCT Badge CCA Badge

Posted: 10/29/15 at 2:20 PM by Matt.Ellis

Glad its not just me, i am going to put in a call with Apple enterprise support later today. if i get any info from them i will post it here.

CCT Badge CCA Badge

Posted: 10/29/15 at 4:12 PM by Matt.Ellis

So they have no initial clue, there asking me to run a log capture after the updates disable themselves so hopefully i can get that to then in a few hours.

CCA Badge

Posted: 10/30/15 at 6:47 AM by francksartori

Hi from France. FYI, I confirm that the issue is still there with Server 5.0.15 on OS X 10.11.1. The enabled updates are disabled after some minutes or hours. That is really annoying. Did someone yet open an bug report at Apple and have received a "duplicate" status ?

CCT Badge CCA Badge

Posted: 10/30/15 at 9:46 AM by Matt.Ellis

I havent put in a bug report yet as im working with there Enterprise support/ engineering team

Posted: 11/1/15 at 7:11 PM by claven

We are seeing the same thing. I've opened up case 976946712.

I've wiped and reinstalled with the same behavior after letting it sync up overnight. For us it is every update since 10/1/2015 that goes to the disabled state.

Mac Mini Late 2012
OS 10.11.1
Server 5.0.15

CCA Badge CMA Badge

Posted: 11/2/15 at 10:12 AM by dgreening

I did a permissions repair on one of my Mini DPs first thing this morning, and so far the enablement status of 10.11 updates is holding steady. Stay tuned.

CCT Badge CCA Badge

Posted: 11/2/15 at 10:16 AM by Matt.Ellis

Ill give that a shot, still havent heard back from apple. So i can't run disk permissions as im on 10.11 and it does that automajically :( but System integrity protection is on and should be maintaining that.

CCA Badge CMA Badge

Posted: 11/2/15 at 10:51 AM by dgreening

Scratch that the updates just disabled themselves again. Here is what I am seeing in the swupd log file for the sync:

Nov 2 09:45:34 bosjssdp1.sapient.com swupd_syncd[25388] <Info>: ========== Sync Started ==========
Nov 2 09:45:34 bosjssdp1.sapient.com swupd_syncd[25388] <Info>: Checking service data location: /Library/Server/Software Update/Data/html
Nov 2 09:45:34 bosjssdp1.sapient.com swupd_syncd[25388] <Info>: Retrieving catalog list
Nov 2 09:45:34 bosjssdp1.sapient.com swupd_syncd[25388] <Info>: Retrieving deprecated updates list
2015-11-02 09:45:34.738 swupd_syncd[25388:1711160] Failed to obtain sandbox extension for path=/var/empty/Library/Caches/swupd_syncd. Errno:2
Nov 2 09:45:35 bosjssdp1.sapient.com swupd_syncd[25388] <Info>: Retrieving remote catalog (STANDARD): index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
Nov 2 09:45:37 bosjssdp1.sapient.com swupd_syncd[25388] <Info>: Retrieving remote catalog (STANDARD): index-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
Nov 2 09:45:40 bosjssdp1.sapient.com swupd_syncd[25388] <Info>: Retrieving remote catalog (STANDARD): index-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
Nov 2 09:45:41 bosjssdp1.sapient.com swupd_syncd[25388] <Info>: Retrieving remote catalog (STANDARD): index-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
Nov 2 09:45:42 bosjssdp1.sapient.com swupd_syncd[25388] <Info>: Retrieving remote catalog (STANDARD): index-lion-snowleopard-leopard.merged-1.sucatalog
Nov 2 09:45:44 bosjssdp1.sapient.com swupd_syncd[25388] <Info>: Retrieving remote catalog (STANDARD): index-leopard-snowleopard.merged-1.sucatalog
Nov 2 09:45:46 bosjssdp1.sapient.com swupd_syncd[25388] <Info>: Updating local catalog: index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
Nov 2 09:47:38 bosjssdp1.sapient.com swupd_syncd[25388] <Info>: *

Nothing out of the usual...

CCT Badge CCA Badge

Posted: 11/2/15 at 11:04 AM by Matt.Ellis

If you want to open a ticket with apple my case# is 974711947. Claven i gave my rep your case number so they could compare. as it looks like we are on identical software / hardware.

CCA Badge CMA Badge

Posted: 11/2/15 at 2:25 PM by dgreening

I upgraded one of my DPs to 10.11.1 and am going to watch and see if this problem still pops up...

CCA Badge CMA Badge

Posted: 11/3/15 at 8:39 AM by dgreening

Installing 10.11.1 did not fix this issue. Updates still disabled... SIGH

CCA Badge CMA Badge

Posted: 11/3/15 at 9:34 AM by dgreening

Something interesting that I found in the swupdate settings (by running /Applications/Server.app/Contents/ServerRoot/usr/sbin/serveradmin fullstatus swupdate):

swupdate:state = "RUNNING"
swupdate:lastChecktime = 2015-11-02 21:30:05 +0000
swupdate:autoMirrorOnlyNew = no
swupdate:syncServiceState = "RUNNING"
swupdate:startTime = 2015-11-03 15:38:26 +0000
swupdate:lastProductsUpdate = 2015-11-03 15:37:56 +0000
swupdate:logPaths:swupdateServiceLog = "/Library/Server/Software Update/Log/swupd_syncd.log"
swupdate:logPaths:swupdateErrorLog = "/Library/Server/Software Update/Log/swupd_error.log"
swupdate:logPaths:swupdateAccessLog = "/Library/Server/Software Update/Log/swupd_access.log"
swupdate:pluginVers = "10.11.111 (111)"
swupdate:checkError = no
swupdate:autoEnable = no
swupdate:updatesDocRoot = "/Library/Server/Software Update/Data/"
swupdate:hostServiceState = "RUNNING"
swupdate:autoMirror = yes
swupdate:numOfEnabledPkg = 1011
swupdate:servicePortsAreRestricted = "NO"
swupdate:numOfMirroredPkg = 1207
swupdate:setStateVersion = 1
swupdate:syncStatus = "DONE"
swupdate:readWriteSettingsVersion = 1

I have enabled all but two updates in the GUI, so the enabled count should be 1205, not 1011. That is very strange! I submitted a bug report with Apple...

CCT Badge CCA Badge

Posted: 11/3/15 at 12:00 PM by Matt.Ellis

Mines even more fun after enabling about 30 updates i see this: it has to be some sort of bug not showing the correct amount of whats enabled then a process runs about 3 hours later and fixes the UI issue that shows them as enabled.

swupdate
swupdate:state = "RUNNING"
swupdate:lastChecktime = 2015-11-03 11:00:05 +0000
swupdate:autoMirrorOnlyNew = no
swupdate:syncServiceState = "RUNNING"
swupdate:startTime = 2015-10-29 20:41:02 +0000
swupdate:lastProductsUpdate = 2015-11-03 11:14:13 +0000
swupdate:logPaths:swupdateServiceLog = "/Library/Server/Software Update/Log/swupd_syncd.log"
swupdate:logPaths:swupdateErrorLog = "/Library/Server/Software Update/Log/swupd_error.log"
swupdate:logPaths:swupdateAccessLog = "/Library/Server/Software Update/Log/swupd_access.log"
swupdate:pluginVers = "10.11.111 (111)"
swupdate:checkError = no
swupdate:autoEnable = no
swupdate:updatesDocRoot = "/Library/Server/Software Update/Data/"
swupdate:hostServiceState = "RUNNING"
swupdate:autoMirror = yes
swupdate:numOfEnabledPkg = 0
swupdate:servicePortsAreRestricted = "NO"
swupdate:numOfMirroredPkg = 1205
swupdate:setStateVersion = 1
swupdate:syncStatus = "DONE"
swupdate:readWriteSettingsVersion = 1

CCA Badge CMA Badge

Posted: 11/3/15 at 1:09 PM by dgreening

Hummm appears Server 5.0.15 is out as an update for 5.0.4...

CCA Badge CMA Badge

Posted: 11/4/15 at 8:51 AM by dgreening

Server 5.0.15 with OS X 10.11.1 still disabling the updates.... Sigh... Does anyone know where ASUS stores the enablement status of updates?

CCT Badge CCA Badge

Posted: 11/5/15 at 10:25 AM by Matt.Ellis

So spoke to apple they cant reproduce the issue, but believe a combination of reformat / reinstall of the system plus having my network guys setting up a A record and PTR record in DNS might resolve the issue.

Waiting on my network team to do its part. will let you know once i get it all up and running again.

CCA Badge CMA Badge

Posted: 11/5/15 at 11:28 AM by dgreening

Yeah reformat of the system isn't going to fly. Our servers resolve both forward and reverse, and are not accessible outside of our network. They all have A records, but not PTR records.

Here is a thread over on Apple Support about this: Apple Support Discussion

Maybe time to look at Reposado more closely...

CCT Badge CCA Badge

Posted: 11/5/15 at 11:40 AM by Matt.Ellis

Hehe i started that thread, there first got no help so opened this one up here.

CCA Badge CMA Badge

Posted: 11/5/15 at 2:04 PM by dgreening

So I did a bit more digging through the config files for ASUS and found that the enablement status <key>enable</key> in /Library/Server/Software\ Update/Status/com.apple.sever.swupdate.plist is not being set to true when enabling an update (10.11.1 in this case). You enable it in the GUI and look at that file, and you will see that the status is still disabled.

It seems like there is some disconnect between what you do in the GUI and the status in this file. When I enable an update I do see this file as modified, but it doesn't set the enabled update as true...

I compared the file permissions for for the config files with an older SUS server (10.8.5, server 2 based) with the newer ones, and everything seems to line up. No lock flags (system or user) on that plist...

Posted: 11/5/15 at 7:39 PM by claven

I heard back from Apple support on this. Hopefully a fix is around the bend.

Here is the CliffsNotes version:

After researching this exhibited symptom, it is related to a similar report currently being investigated by Engineering. I have associated this report to the case and provided the logs to the report to help further the investigation. In testing, it has been reproduced on OS X 10.10.5 / OS X Server 5.0.4 as well. Once there is information to offer you, I will do so promptly.

CCA Badge CMA Badge

Posted: 11/5/15 at 10:25 PM by dgreening

Excellent. Thanks for the update. I expect to be speaking with Apple on this tomorrow as well.

Posted: 11/6/15 at 2:44 AM by sean

If you are only just setting up a SUS, then you might want to look at Reposado instead:

Reposado overview

Reposado github repo

and if you like a web interface over command line:

Margarita

It is more flexible than Apple's, with multiple branches for different machines, allows for deprecated updates if you desire and you aren't limited by the server OS version.

Intro to Reposado

CCA Badge CMA Badge

Posted: 11/6/15 at 8:43 AM by dgreening

Yep, I have used Reposado in a prior job, and it's quite nice. We are a ASUS environment here, and will continue to be for the foreseeable future.

CCT Badge CCA Badge

Posted: 11/6/15 at 9:33 AM by Matt.Ellis

My guy is working with engineering as well, he couldn't reproduce it but they did tell me it was a know issue. ill look into those other programs as im not tied to just Apples SUS

CCT Badge CCA Badge

Posted: 11/11/15 at 10:21 AM by Matt.Ellis

Ok so my issue is resolved. not sure why this worked but so far for 24 hours my updates have not been disabled

Keep in mind this was a test machine but here are the steps i took:

  1. Setup a fully static ip and A/ PTR record
  2. Fully reformatted and install / updated 10.11.1
  3. Downloaded Server app and setup DNS (all i did was turn it on) and software update service
  4. downloaded and enabled all updates from 2015 minus the voice packs.

And 24 hours later i still have enabled updates!

CCA Badge CMA Badge

Posted: 11/12/15 at 8:53 AM by dgreening

Interesting. Unfortunately wiping and re-installing on our DPs is not an option, as we have 30+ around the globe. Apple suggested turning off automatic downloads, but that didn't have any effect.

Posted: 11/12/15 at 3:12 PM by kish.jayson

Ran into this exact same issue on two separate servers today, both of which are running OS X Yosemite (10.10.5). One server is currently running Server 5.0.4 while the other is 5.0.15. I contacted AppleCare Enterprise Support today and they were able to reproduce the issue on their test system as well. Case Number is 986233263.

Thank you @dgreening for figuring out where the Enable flag is being stored. I'm going to see about scripting something to change this flag on my test server as an interim workaround.

I'll let everyone know if it's successful.

Posted: 11/13/15 at 8:45 AM by kish.jayson

UPDATE

I stopped services on both servers, then deleted the contents of /Library/Server/Software Update/. I then configured the Software Update Server to Manual mode, and left "Automatically download new updates" unchecked.

I then selected all of the available updates, then chose "Download and Enable". This allowed each of the updates to be downloaded successfully and then properly set the enabled flag correctly in /Library/Server/Software Update/Status/com.apple.server.swupdate.plist.

While not yet tested, I presume that stopping services, then manually updating this flag from <true/> to <false/> should effectively disable the applicable update as well.

Posted: 11/13/15 at 10:52 AM by agerrg

Since I have upgraded to Server 5.0.15, the 'Enable, Disable, Remove' Status changes without my input. I have Enabled the updates that our environment requires and they change back to ‘Disabled’ after a day or two.

CCA Badge CMA Badge

Posted: 11/13/15 at 11:20 AM by dgreening

Yup I have seen that as well. Apple has all but admitted that Server 5.0.15/5.0.4 is borked when it comes to El Cap updates. Lets hope we see a new Server.app sooner rather than later.

CCA Badge CMA Badge

Posted: 12/10/15 at 3:22 PM by dgreening

Still having this issue. Updated one of the DP/SUS servers to 10.11.2, same deal. Crickets from Apple so far...

CCT Badge CCA Badge

Posted: 12/10/15 at 4:53 PM by Matt.Ellis

I upgraded my system to 10.11.2 yesterday and its still working. but like i said i had to wipe the whole system

CCA Badge

Posted: 1/5/16 at 10:15 AM by ssmurphy

Also opened a bug report 24056668, trying the build as new server on test hardware now. Don't like the idea of having to rebuild a large number of ASUS servers in our environment.

CCT Badge CCA Badge

Posted: 1/5/16 at 10:26 AM by Matt.Ellis

Mine is now doing this again. i have about 450 updates that stay enabled but anything from December forward keeps getting disabled.

Submitted my own bug glad this thing is still in testing

Apple Bug 24056937

CCA Badge CMA Badge

Posted: 1/5/16 at 11:13 AM by jameswaltrip

Did any one in this "club" find a solid solution? I applied the Apple Security updates in December and after rebooting some of the updates stay enabled and some of the older ones before the Security update install don't(I have to keep checking them and enabling them). Just wanted to see if there was any other progress.

Posted: 1/5/16 at 11:27 AM by mikkim

And I thought I was crazy! I'm having the same issue here. I'm new to Mac servers so I thought I was just making a silly mistake. I hope Apple can give us something helpful.

CCA Badge CMA Badge

Posted: 1/5/16 at 12:42 PM by dgreening

We are still having this issue with Server 5.0.15. We have had some success rolling back to Server 4.1.3 for the time being... Still waiting to hear an update from Apple on this...

CCA Badge CJA Badge

Posted: 1/5/16 at 12:44 PM by Chris.Ball

We are also still having issues. I submitted a bug report with Apple and have contacted our SE. I hope we will seen an update soon since this has been ongoing for several months in our environment.

CCA Badge CMA Badge

Posted: 1/5/16 at 12:52 PM by dgreening

You know something is screwy when they release Server 5.0.15 as an update to Server 5.0.4...

CCA Badge

Posted: 1/5/16 at 2:15 PM by ssmurphy

I spun up a fresh iMac with OS X 10.11.2 and Server 5.0.15. The Software Updates are syncing from Apples servers at this time. Expect it to be done sometime tonight. Once finished will see if changing the settings will stick for the updates.

Not sure if it will work, and not sure I will trust it if it looks like its working.

CCA Badge

Posted: 1/6/16 at 1:26 PM by ssmurphy

So spinning up a new server clean with just OS X 10.11.2 and Server 5.0.15 was a big fail.

The update packages will not except any changes to being active or inactive.

will have to point all our internal clients to one of our older (10.10.5 server 4.0) ASUS for updates until this is fixed.

CCA Badge CMA Badge

Posted: 1/6/16 at 1:36 PM by dgreening

I would really encourage everyone who is experiencing this issue to contact your SE at Apple and let them know that this is an issue for you. Apple IS aware of the issue, but it doesn't seem like enough of a fire has been lit under their butts to get this fixed in a timely manner.

CCA Badge

Posted: 1/6/16 at 2:08 PM by mm2270

Apple IS aware of the issue, but it doesn't seem like enough of a fire has been lit under their butts to get this fixed in a timely manner.

And what else is new? Besides the year that is. Unless this impacts Apple's bottom line in some way, they have little incentive to fix it quickly. Apple's more or less out of the server business anyway, not just with their hardware. Once they started dumbing down OS X Server to basically point and click functions with little control or oversight on how they work is when I gave up on the product. They probably think everyone should just allow all updates to be installed directly from Apple all the time anyway. And upgrade all your Macs to the latest OS X release as soon as its out too by the way!

I would actually encourage anyone running into this to look at spinning up a Reposado instance and ditch Apple's OS X Server if possible, and let your Apple SE know what you did and why. And you get the bonus of being able to set up branches if you use Reposado.

CCA Badge CMA Badge

Posted: 1/6/16 at 2:11 PM by dgreening

optional image ALT text

CCA Badge CMA Badge

Posted: 1/14/16 at 9:31 AM by dgreening

There is a new Server beta up on the Dev site, but it requires 10.11.4 beta...

Posted: 1/14/16 at 7:56 PM by mrice

Apple have told me 5.1 beta doesn't fix the issue...

CCA Badge CJA Badge

Posted: 2/1/16 at 8:58 PM by mtafirozee

I am having the same issue and waiting for some update through this thread. And for me, the only available option is to use Apple Software Update, not anything else.

In the mean time, I am planning a workaround using a second OS X server which will set to auto enable all the updates. Because, if the server is setup to Auto Enable all, it remains enable.

The configuration:
1. Server1 is configured to get the Updates from Apple and the updates will be manually enabled
2. Server2 will be configured to get its updates from Server1 and will be configured to Automatically download and enable all
3. Clients will get updates from Server2

The execution:
1. I'll manually enable all the desired updated on Server1.
2. Force Server2 to check for updates immediately. So that it gets all the software updates from Server1 immediately before the updates gets disabled!!
3. The clients check with Server2 and the updates are there.

Hope Apple resolves this issue immediately.

__
Mohammad

CCT Badge CCA Badge

Posted: 2/8/16 at 5:28 PM by Matt.Ellis

Anyone ever find a good solution, I have tired setting up both a Netsus and Reposado system but cant get anything to connect to them. So im 100% stuck. No one at apple has any info nor do they seem to care.

Posted: 2/9/16 at 8:59 AM by kish.jayson

@Matt.Ellis I setup the Software Update Service from scratch on our server, placed it in Manual Mode and unchecked Automatically download new updates so that new updates only appear as Available. Then I select Download and Enable ONLY when I'm ready to deploy them.

This method has worked fine for us the last few months, but then again we've rarely ever had the need to disable an update once it's already been enabled. Then I could see it being problematic.

CCA Badge CJA Badge CMA Badge

Posted: 2/9/16 at 4:54 PM by yellow

I'm reaching the end of my rope on this ridiculousness. I tried all the suggestions on our existing server. I've vanilla imaged a new server.
I've kept it simple, followed every suggest best practice.
And and this still happens. I enable something today, tomorrow, it's disabled. The command line and the GUI versions don't appear to have anything to do with each other.
All of us here work hard (including JAMF) to try and keep these Apple devices functional in enterprise environments of varying sizes, and the one group that SHOULD care, Apple, doesn't give a damn.

Posted: 2/9/16 at 6:25 PM by claven

Hi All,

In regards to our case 976946712, I tested a script today from Apple that should help keep the updates enabled after manually setting them to the enabled state. Fingers crossed, so far so good, but we are waiting until Friday to see if it holds in our environment.

Curt

CCA Badge

Posted: 2/10/16 at 5:22 AM by carlo.anselmi

Hello everyone, just wanted to confirm me too I cannot make SUS working correctly with OSX 10.11.3/Server App 5.0.15
Waiting for a solution, I ended up resurrecting an old 10.9.5/Server App 3.2.1 serving El Capt clients with the old trick of modifying the relevant parts in

/Library/Server/Software Update/Config/swupd.conf

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTP_USER_AGENT} Darwin/10
    RewriteRule ^/index\.sucatalog$ http://%{HTTP_HOST}/cgi-bin/SoftwareUpdateServerGetCatalog?/index-leopard-snowleopard.merged-1.sucatalog
    RewriteCond %{HTTP_USER_AGENT} Darwin/11
    RewriteRule ^/index\.sucatalog$ http://%{HTTP_HOST}/cgi-bin/SoftwareUpdateServerGetCatalog?/index-lion-snowleopard-leopard.merged-1.sucatalog
    RewriteCond %{HTTP_USER_AGENT} Darwin/12
    RewriteRule ^/index\.sucatalog$ http://%{HTTP_HOST}/cgi-bin/SoftwareUpdateServerGetCatalog?/index-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
    RewriteCond %{HTTP_USER_AGENT} Darwin/13
    RewriteRule ^/index\.sucatalog$ http://%{HTTP_HOST}/cgi-bin/SoftwareUpdateServerGetCatalog?/index-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
    RewriteCond %{HTTP_USER_AGENT} Darwin/14
    RewriteRule ^/index\.sucatalog$ http://%{HTTP_HOST}/cgi-bin/SoftwareUpdateServerGetCatalog?/index-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
    RewriteCond %{HTTP_USER_AGENT} Darwin/15
    RewriteRule ^/index\.sucatalog$ http://%{HTTP_HOST}/cgi-bin/SoftwareUpdateServerGetCatalog?/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog
</IfModule>

and /Library/Server/Software Update/Config/swupd.plist

<array>
<string>index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog</string>
<string>index-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog</string>
<string>index-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog</string>
<string>index-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog</string>
<string>index-lion-snowleopard-leopard.merged-1.sucatalog</string>
<string>index-leopard-snowleopard.merged-1.sucatalog</string>
</array>

This should also work with Yosemite Server 4.x SUS

Posted: 2/17/16 at 4:37 PM by anix

@claven Did your script work?

Posted: 2/17/16 at 5:43 PM by claven

@anix Sort of. I checked and I had 8 updates that reverted back to disabled sometime over the weekend. I just sent a log package in for Apple to review. It feels like progress though :)

Posted: 2/18/16 at 5:07 AM by anix

@claven A few updates were automatically disabled even when our SUS worked fine (e.g. 031-48511, XProtectPlistConfigData 1.0), maybe invalidated by Apple after release.

You have mentioned a script. Is it a patched version of one of the existing SUS scripts, or is it an additional script that is supposed to fix data / cache issues?

Posted: 2/18/16 at 6:56 AM by claven

Morning @anix

Most of the ones that are disabling on our SUS box seem like they still should be valid. Here is a screen capture of the ones that are going back to disabled/available. I can live with where our SUS is now compared to everything from 10/1/2015 forward being disabled.

On the script, from my understanding it should set the updates from pending to enabled. I checked and Apple does not want me to post it at this time since it is an engineering test only.

Curt

Posted: 2/18/16 at 7:57 AM by anix

@claven Thank you for the list. I'm rather certain, most of these updates were those that have been automatically disabled when our SUS worked flawlessly. Only exception is AppleConnect and SafeViewUAT which were not available until our SUS stopped working. Maybe someone with no SUS issues can confirm this.

I hope Apple will release a fix soon.

CCA Badge CJA Badge CMA Badge

Posted: 2/18/16 at 10:00 AM by yellow

In the end, I thought about what was important to me here... and that was hosting the SUS internally so clients don't have to reach out to download content when it's local. While being able to test the patches first is also very important, since I cannot get the SUS to behave the way I want and having repeatedly disabled patches (note: 10.11.3 Update & Combo Update would get disabled! That's a big deal to me.), and facing the prospect of not using the SUS at all and have client download the content without testing anyway... I endeavored to try and get this to work.

And in the end, it's working.

Forgive me, because I tried MANY time to reset this so I could make it work the way I wanted and it would always end up in varying states of failure, so I finally settled on something that appears to be working, I will try and retell the steps I took. Some of the steps are possibly pointless, but I did them out of desperation and some voodoo.

This was on a vanilla re-image of OS X 10.11.3 with Server 5.015.

I turned off SUS in the Server.app.
I rebooted the server. (Pointless?)
I removed the "Software Update" directory and all t's content from /Library/Server/.
I rebooted the server. (Pointless?)
I opened Server.app chose "Automatic" to download & enable content (this PAINS me still).
I quit Server.app. (Pointless?)
I opened Terminal and did "sudo swupd_syncd" and let it do it's thing.

All content was downloaded, mirrored, and enabled for my institution going on..... 8 days now?

[A note about the "Pointless?" from above. I've no evidence that these steps are useful in any way, however, given the issues that I'd had trying to get the SUS to work, I felt the need to get a little medieval with my approach to nuking the SUS, making SURE it was nuked, and starting over.]

CCT Badge CCA Badge

Posted: 3/1/16 at 3:43 PM by Matt.Ellis

@yellow Any updated on your steps. last time i did the full wipe mine worked for a few weeks and then started disabling things again. Would love to here if your is up and running.

CCA Badge CJA Badge CMA Badge

Posted: 3/1/16 at 4:59 PM by yellow

It is indeed still running, and updating.

Posted: 3/16/16 at 12:58 PM by mrice

Apple have said this should be fixed in OS X Server 5.1 beta 6.

Posted: 3/16/16 at 1:10 PM by mrice

Apple have said this should be fixed in OS X Server 5.1 beta 6.

Posted: 3/21/16 at 8:31 PM by claven

10.11.4 / Server 5.1 appear to be out as of today, updating our SUS tonight, fingers crossed!

Posted: 3/22/16 at 2:57 PM by navek

Any word on a fix for OS X Server for 10.10.x. Server 5.1 is 10.11.4 only. I now need to upgrade multiple production servers from OS X 10.10.x to 10.11.4 just for Software Update.

This is crazy! Five months! How about fixing the problem not forcing an upgrade of everything.

You are killing me Apple!

CCT Badge CCA Badge

Posted: 3/22/16 at 4:12 PM by Matt.Ellis

I can say i have been working with apple on testing beta versions of Server and 10.11.4 and as of the last beta version issue is not fixed. they cannot reproduce it. So im guessing i need to wipe my system for the 7th time and install the released items.

Posted: 3/22/16 at 4:24 PM by anix

I have upgraded to 10.11.4 and Server 5.1, then clean wiped SUS as suggested by Apple enterprise support, i.e. stopped the service, reboot, clean wiped /Library/Server/Software Update, emptied trash, reboot, and restarted SUS... issue not fixed. All enabled products are silently disabled after a short time. Very disappointed.

CCT Badge CCA Badge

Posted: 3/22/16 at 5:26 PM by Matt.Ellis

Since ive always wanted to reformat a system for the 8th time im trying again but not hopeful... this is just beyond unacceptable.

CCT Badge CCA Badge

Posted: 3/23/16 at 3:28 PM by Matt.Ellis

And as im sure you all guessed the release version of 5.1 is still broken. Im waiting to hear from apple engineering.

CCA Badge CJA Badge CMA Badge

Posted: 3/23/16 at 4:44 PM by yellow

42 days uptime... my SUS automatically downloaded and hosted the latest patches.

CCA Badge

Posted: 3/24/16 at 7:04 AM by ssmurphy

So still seeing the random switching of status for updates on the ASUS servers that had the issue when running OS X 10.11.3 and Server 5.0.15. Updating them to OS X 10.11.4 and Server 5.1 did not fix the issue for us.

No happy as we have 12 ASUS servers with half of them off line because we need to control Apple Software Update releases in our environment.

Anyone have a good resource for setting up a Reposado Server other then the source at https://github.com/wdas/reposado

Thinking of tips and tricks for setup, care and feeding.

thanks,

Posted: 3/24/16 at 8:15 AM by LSinNY

here ya go:

Ubuntu:here
Centos:here. have used this one for past 4yrs. Keep the github link handy for any customizations

Good luck

Larry

Posted: 3/29/16 at 9:57 AM by anix

Finally! Paint me surprised, but somehow ASUS finally stopped disabling updates.

I have repeated the instructions I have mentioned in my previous post a few times since then (no other updates applied). And now, I think at the fourth attempt, the Software Update Service works as expected.

Although no software updates or configuration changes happened on the server, there are a few differences to my previous failed attempts:

  1. After turning ASUS on again (mind: manual enabling and downloading), I have waited for around 24 hours with-out enabling or doing anything in the products list. Just let the server retrieve the complete list of updates.
  2. Then I chose "Download & Enable" for only one of the recent products. Waited until it was downloaded and enabled, plus a few hours, where normally they get silently disabled. But the product was still enabled, so I repeated with a second product, and so on, but always waited for the current product to be downloaded and enabled, before issuing the command for the next product.
  3. After a dozen products or so, I selected products to download & enable with-out waiting for each one to be downloaded & enabled first. However, I always selected a single product only per command. In my previous failed attempts I had selected multiple products at once.

This ASUS is now running for a few days and I have still all the products enabled (around 60 products). Normally, the server disabled all products after only a few hours. So this is definitely an improvement. I'm getting almost optimistic.

CCT Badge CCA Badge

Posted: 3/29/16 at 10:17 AM by Matt.Ellis

Wish i could say the same official line from Apple engineering is some people are still having the issue. Needless to say when they asked me to reformat for the 10th time. I politely told them to pound sand. Ill spend my time setting up a reposado server instead of wasting it on fixing a 6 month old bug.

CCA Badge CMA Badge

Posted: 3/29/16 at 10:59 AM by dgreening

Yeah... I am working on getting a Reposado test box up as well. Getting it running on Server.app 5.1 has been interesting so far.

Posted: 4/1/16 at 5:38 PM by timtimtim

Hi,

i'm having the same issue after installing 10.11.4 and Server 5.1.

Everytime I enable some updates, over time the get automatically disabled. When i look into the folder: /Library/Server/Software Update/Status/.pending the updates show up here: for example: .ticket_enable_031-53822.

I tried removing the files in the .pending folder. But that just disables the updates faster.

I have no problem i removing all the files and start over again in a weekend, but I read somewhere that that just means that more updates are getting disabled automatically.

Sure hope Apple fixes this problem fast.

Posted: 4/6/16 at 8:34 AM by timtimtim

I was just on the phone with Apple, I mentioned the incident number: 986233263 (from kish.jayson). The support guy said it was a known issue and that it was on the top of the priority list. I can see that there's a Beta (version 5.1.4) submitted: http://adcdownload.apple.com/OS_X_Server/OS_X_Server_5.1.4_beta/OS_X_Server_5.1.4_beta_Release_Notes.pdf

It only says: -bug fixes ..but one can always hope.

CCA Badge CMA Badge

Posted: 4/6/16 at 8:45 AM by dgreening

Definitely still happening on 10.11.4/Server 5.1. Lets hope the 5.1.4 beta fixes it... 7 months later...

Posted: 4/7/16 at 9:29 AM by timtimtim

Yesterday a new beta update is released (together with 10.11.5 beta): OS X Server v5.1.4 beta 2.

CCA Badge

Posted: 4/13/16 at 11:41 AM by ssmurphy

Saw that Beta today as well. Spinning up a test server with it now.

Will report back once Software Updates are synced and its had a few days to show if the auto enable/disable bug is still happening.

CCA Badge

Posted: 4/14/16 at 9:25 AM by ssmurphy

Well that did not take long. On a fresh system with OS X 10.11.5 beta and Server5.1.4 Beta 2 still seeing the same issues as before.

Disable some of the software updates, come back a few hours later and they are re-enabled.

CCA Badge CMA Badge

Posted: 4/14/16 at 3:38 PM by spowell01

We are seeing this exact same issue with our 10.11 SUS and have been for quite some time now. Worked with apple and they were never able to get us a fix of any sort.

Posted: 4/21/16 at 3:02 AM by timtimtim

The updates that gave me problems were the OS X El Capitan updates (031-53826, 031-53827 and 031-53822). It seems 2 out of three are nou enabled and stay that way. I downloaded and enabled 1 of them. I think part of a workaround is to have 1 action at once. I checked every time if the .pending (/Library/Server/Software\ Update/Status/.pending/) folder was empty before taking the next action. It seems to have worked for 2 of the updates.

My guess is that there's something going wrong with the deprecating updates, maybe even on the hosting servers from Apple itself. But that's just guessing...

CCA Badge

Posted: 5/18/16 at 12:43 PM by breatheforme

Still doesn't work for me with Server Update 5.1.5

CCA Badge CMA Badge

Posted: 5/19/16 at 1:04 PM by spowell01

Still broken for us with the latest 10.11.5 and server updates as well. Apple actually sent me a new mac mini during our initial troubleshooting of this issue and of course it had the same issue as our original mini. They have pretty much stopped responding to my emails on this case as well. So i have our old mac and the new mac they sent me, and i guess i get to keep them both lol. Between the broken SUS issue and the broken NetRestore issue, i'm really getting the feeling that apple might be closer to just kicking their entire server product out the window.

Posted: 5/19/16 at 1:08 PM by claven

I ran our test script from Apple on Server 5.1.5 and it is still working to set and keep the updates enabled. They won't let me share it, but have them reference our case 976946712 to see if they will share it with others.

Curt

CCA Badge CMA Badge

Posted: 5/19/16 at 1:10 PM by dgreening

Yeah, that script from Apple is working for us as well. SO ANNOYING!!!

CCA Badge CMA Badge

Posted: 5/20/16 at 12:55 PM by spowell01

Thanks Claven i will see if i can get them to pass that script on to me

Posted: 5/23/16 at 3:00 PM by hinrichd

Does anyone know if the secret Apple script is now available for all?

Posted: 5/24/16 at 4:39 AM by JCooper

Hi all,

Having read the thread i'm having the same issues, just wondered if anyone else had seen this in the error logs?

May 24 10:29:03 ** com.apple.cts[61]: com.apple.periodic-monthly: scheduler_evaluate_activity told me to run this job; however, but the start time isn't for 2321179 seconds. Ignoring.

24/05/2016 09:09:25.882 swupd_syncd[22069]: download request received for unknown product (031-45690)

I'm seeing these errors when i click on a new update, doesnt matter what the update - mainly 10.11.2, the message always appears.

Any help appreciated.

CCA Badge CMA Badge

Posted: 5/24/16 at 11:13 AM by spowell01

I don't believe the magic script is available publicly but after putting our attack dog on apple, he was able to get the script within a day. So far we are on day 1 of success which we haven't been able to obtain yet.

Posted: 5/25/16 at 8:02 AM by Max!

Hi , all!

I have a question for claven and dgreening.
Why you can't share this script with us? Is it a top secret information or something else?

Posted: 5/25/16 at 8:04 AM by millersc

Apple NDA is not something to mess with. I'm sure if they (Apple) finds the script working they will integrate or release it into the wild soon enough.

CCA Badge CMA Badge

Posted: 5/25/16 at 8:20 AM by dgreening

Yeah, I'm not going to break our NDA...

It's kind of crazy that Apple has been providing this script for almost 6 months and has gone through 2ish releases of Server.app and has not yet been able to fix this issue in the product.

Posted: 5/25/16 at 9:20 AM by Max!

How you received this script? Do you have a special support from Apple (e.g. AppleCare OS Support)?
I've also called to them, but haven't received any information about workaround of the issue, only an advice to do it manually.

CCA Badge CMA Badge

Posted: 5/25/16 at 9:29 AM by dgreening

I believe we have AppleCare Alliance. You can't just call Apple Support and get the script. They will probably have no idea what you are talking about...

CCA Badge CMA Badge

Posted: 5/25/16 at 11:58 AM by spowell01

We have an applecare preferred support agreement. We also have apple reps almost monthly at our district that we do poke and prod to make cases progress quicker.

I think we all agree that we can't break the NDA regarding the script, but it is absolutely ridiculous that they haven't been able to bake this script fix into the final product.

CCA Badge CMA Badge

Posted: 5/25/16 at 9:35 PM by jameswaltrip

If you are only using the Software Updates, I have found a fix by trashing the Server folder and setting up the Server app as a new setup. Trashing just the Software Updates doesn't fix it.
If you are using the Server app for other services, then I wouldn't do this.
Instructions below:
OS X 10.10.5 with Server 5.0.15 and also OS X 10.11.5 with Server 5.1.5
1) Turn off the Software Updates Service
2) Quit Server app
3) Find the Server folder in /Library and trash it. (Trashing just the Software Updates folder doesn't work)
4) Reboot and empty the trash.
5) Launch Server app (it will be a new Server setup)
6) Within Software Updates, Settings tab, Mode Manual (We manage our updates so no Automatic)
7) In Updates tab, do not check the Automatically Download Updates box, this is where I find the problem is.
8) Allow updates to download and show Available but do nothing until it has downloaded everything and do not run any terminal commands to sync or anything. This also caused a problem for me.
9) Once all the updates have downloaded and enable one and wait for it to finish, and move to the next one (Command R will Refresh). Enabling a bunch at once might cause an issue we but have not tested fully it.
As a test, enable one and check back after a few hours (I find 4 hours a good test point) and see if it stays Enabled. I have had success on three Mac Servers.
God luck!
James

CCA Badge

Posted: 5/28/16 at 10:49 AM by carlo.anselmi

Hello everyone, I have the opposite behavior... can't disable/delete any update. Once downloaded, they ALL remain enabled.
Hope it will be fixed soon...
OS X 10.11.5 with Server 5.1.5
Cheers
Carlo

CCA Badge

Posted: 6/16/16 at 9:41 AM by ssmurphy

Reading the Server 5.2 beta Release Notes points to this issue never being fixed.

Wonder if they will release a new tool to do this or are they going to force us to a third party solution? If its the latter, how long will that work before they stop working as well.

CCA Badge CMA Badge

Posted: 6/16/16 at 9:53 AM by dgreening

Interesting. VERY INTERESTING. I wonder if they are planning of rolling ASUS into the Caching Server functionality...

CCA Badge

Posted: 6/16/16 at 1:06 PM by breatheforme

I just emailed the tech assigned to my case about the issue flat out asking about the depreciation and how we're supposed to handle managing updates in the future. I doubt i'll get a real response but would be nice to know what they plan on doing.

CCT Badge CCA Badge

Posted: 6/17/16 at 8:09 AM by Matt.Ellis

Funny thing is at my new company, they have ASUS setup and up to date no issues. So strange how random the issue is. But yea sounds like it will be gone shortly.

CCA Badge

Posted: 7/21/16 at 12:00 AM by francksartori

Did someone already take the time to test if the issue is solved with Server 5.1.7 ? I'm actually doing some testing.

CCA Badge

Posted: 7/24/16 at 5:07 AM by carlo.anselmi

Same as my previous post, can't disable enabled updates. :-(
OSX 10.11.6 + Server 5.1.7
Cheers
Carlo

Posted: 7/26/16 at 7:57 AM by timtimtim

Hi,

it seems the problem is back again, after three months.

I downloaded the updates that I wanted on Friday, so by Monday they all had the status ‘Disabled’. I then put the Status on ‘Enabled’. It seemed that it was going allright, til a couple of hours later. The status for these updates were back to ‘disabled’ again.

The way I check it now:
If there are tickets in the /Library/Server/Software Update/Status/.pending folder I know that after a couple of hours the same thing happens.

We’ve tried it with 3 macs, even a freshly installed one.

Posted: 7/28/16 at 5:43 AM by timtimtim

Just a follow up:

i've installed Reposada and Margarita: https://clburlison.com/reposado-guide/ and i love it! It's an easy install en configuration (some basic linux knowledge is needed).

I encourage everybody to do the same.

Posted: 7/29/16 at 6:48 AM by dliberti

Hi All,
As mentioned above seems there is a discrepancy between the status reported within the Server GUI and the value contained "/Library/Server/Software Update/Status/com.apple.server.swupdate.plist" which is the plist loaded by the GUI to display the available patches. The com.apple.server.swupdate.plist has of course a direct dependency with the catalogs where all the informations are stored, so both of them have to be always synchronized. I'm testing a workaround which seems to work (at least till now) so I would like to share it, maybe some of you can test as well in order to have a valid response.

This is what I have done: 1. Quit Server.app
2. Open the Terminal
3. Stop the SWupdate Service -> sudo serveradmin stop swupdate
4. Change the status of a specific patch where 022-3271 is the patch ID (you can get the id by double-click on the patch in the GUI) and NO or YES is value to set (disabled or enabled) with the command ->
sudo /usr/libexec/PlistBuddy -c 'set workingSetProducts:022-3271:enable NO' /Library/Server/Software\ Update/Status/com.apple.server.swupdate.plist
5. Go to folder: /Library/Server/Software Update/html/ and remove all the catalogs and links EXCEPT the "content" folder
6. Go to folder: /Library/Server/Software Update/html/content/ and remove everything EXCEPT the "downloads" folder
7. Again in the Terminal run the synchronisation with the swapple server -> sudo swupd_syncd -sync
Note that the ASU service is still off and must be off.
8. At the end of the synchronisation, it will take some time to finish, start again the service -> sudo serveradmin start swupdate
9. Open Server.app and the patch should be correctly set.

Patches that have not yet been downloaded must be enabled directly by selecting "download and enable".
If you have to re-enable or re-disable patches this has to done following the same process above.
For those who are lazy like and in case of positive feedback, i'll putting together a script to enable/disable patches in a single shot.

please let me know if it works

Posted: 7/29/16 at 6:48 AM by dliberti

I've been able to workaround this issue. Solution has been posted but not published yet.

CCA Badge CMA Badge

Posted: 7/29/16 at 8:44 AM by dgreening

You are using the same method as the script which Apple has been providing to address this issue! Kudos!

Posted: 8/8/16 at 5:28 PM by dliberti

oh really? :) Oh WOW.

CCT Badge CCA Badge

Posted: 8/9/16 at 10:53 AM by Matt.Ellis

So it looks like in the future this will be fixed by apple depreciating ASUS. so bleh..

https://support.apple.com/en-my/HT206871

Posted: 8/9/16 at 11:01 AM by kish.jayson

Yeah, I was not happy when I saw that. I've re-opened my AppleCare Enterprise Support Case and am pressing them for both a resolution to the existing issue and guidance on their plans to offer this functionality once SUS has been deprecated. While Caching Service seems promising, it doesn't allow any granularity about which updates are made available and when.

CCT Badge CCA Badge

Posted: 8/9/16 at 12:26 PM by Matt.Ellis

Yea i understand i would suggest looking up https://github.com/wdas/reposado if you want even more control.

Posted: 8/9/16 at 12:32 PM by kish.jayson

@Matt.Ellis This may be my interim fallback, but Reposado's future is contingent on Apple continuing to publish and maintain the Software Update Catalogs. I don't suspect they're going to keep doing so once SUS has officially been removed from the Server application.

Posted: 8/11/16 at 2:12 PM by timtimtim

About deprecating ASUS, I'm really wondering how Apple would like us to schedule updates in the future then. They wouldn't just shut it down now, would they?

Posted: 8/12/16 at 10:08 AM by rgerman

What kind of software update server disables software updates you've enabled. Answer, and Apple Software Update Server!! Pretty bad on Apples part not fixing this... then to have a script that can work around the issue and not share it due to NDA?? Why would they do that? Crazy...

Posted: 8/15/16 at 7:45 AM by jmunzo

Hey guys, been lurking this thread the past few months. I wanted to thank you all for taking the time to document your troubleshooting techniques and solutions.

@dliberti 's method has proved successful for me the past few weeks, and my updates have remained enabled since. I'm not a great programmer, but I quickly put this script together, and have used it the past few days with success, tested on OSX 10.10.5 with Server 4.0.3, OSX 10.11.3 with Server 5.0.15, and OSX 10.11.6 with Server 5.1.7.

https://github.com/jmunzo/OSX-scripts/blob/master/ASUS_Manual_Update.sh

I commented it up as much as possible. Feel free to modify it / point out issues or corrections / tell me it sucks, haha. I know it's temporary, what with Server 5.2 set to deprecate ASUS, but for now this has been tiding me over.

Thanks again for all the information and documentation!

CCT Badge CCA Badge

Posted: Yesterday at 10:13 AM by Matt.Ellis

@kish.jayson Its very possible they wont keep the catalogs going. im hoping they are going to roll some sort of control mechanism into cache server. But i have a strange feeling we are just going to be abandoned and there going to expect corporate users to just trust them on every update.

I hope im wong, but Apple does have a history of forcing change even when its not need or not to the betterment of the user.

Could you give us some feedback on our Casper Suite releases?  This will be quick - we promise!