Skip to content
Workflow for doing an in-place upgrade without user interaction.
Branch: master
Clone or download
Latest commit 5ab7f8e May 9, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
imgs Readme updates Apr 30, 2018
.travis.yml CI Support Sep 25, 2018 Update year of copyright Mar 30, 2019 Clarifications to comments and instructions Sep 28, 2018 Standard error output will be also recorded in the osinstaller log file Apr 13, 2019

macOS Self Service Upgrade Process

Workflow for doing an in-place upgrade without user interaction.

Build Status

This script was designed to be used in a Self Service policy to ensure specific requirements have been met before proceeding with an in-place upgrade to macOS, as well as to address changes Apple has made to the ability to complete macOS upgrades silently.


  • Jamf Pro
  • A logged in user
  • macOS Clients on 10.10.5 or later
  • macOS Installer 10.12.4 or later
  • eraseInstall option is ONLY supported with macOS Installer 10.13.4+ and client-side macOS 10.13+
  • Look over the USER VARIABLES and configure as needed.

This workflow will not work if a user is not logged in since the startosinstall binary requires a user to be logged in. Tested with macOS 10.13.4 and you will get errors in that the process couldn't establish a connection to the WindowServer.

Why is this needed?

Starting with macOS Sierra, Apple has begun enforcing the way in which you can silently call for the OS upgrade process to happen in the background. Because of this change, many common ways that have been used and worked in the past no longer do. This script was created to adhere to Apple's requirements of the startosinstall binary.

This script has been tested on OS X 10.10.5, 10.11.5 and macOS 10.12.5 clients upgrading to 10.12.6 and 10.13.3. As of v2.5 of this script FileVault Authenticated reboots work again!


When you start deploying this script to your end-users you will want to ensure that it is scoped properly. At that very least, you'll want to create a Smart Group to determine if the target system(s) meet the system requirements for the macOS upgrade.

Also, if you are encrypting your macOS devices (which I hope you are), you will want to ensure your scope also includes devices that are not currently encrypting. While the devices are encrypting, you will not be able to upgrade to macOS High Sierra until encryption is complete.

And/Or Criteria Operator Value
FileVault 2 Partition Encryption State is not Encrypting

Configuring the Script

When you open the script you will find some user variables defined on lines 60-118. Here you can specify the message that is displayed to the end user while the script is running and preparing the computer to upgrade to macOS Sierra, as well as the variables used to determine the version and path for the macOS Installer. Also, don't forget to setup a policy with a custom trigger specified as defined in the user variables.

Added in v2.6.0 - You can now specify to use the --eraseInstall parameter when using macOS Installer 10.13.4 or later and the client is running macOS 10.13 or later. Essentially this will wipe and reload the system to factory defaults. Yay \o/

Staging the macOS Installer

In order for this script to work, you will have to have a copy of the macOS Installer that is available from the Mac App Store located in /Applications. One of the easiest ways to achieve this is to package the installer (in PKG format) with Composer as seen below and deploy the package via Jamf Pro.

alt text

Otherwise it can also be packaged using the command line as shown below and deploy the package via Jamf Pro.

pkgbuild --install-location /Applications --component "/path/to/macOSInstallerApp" "/path/to/xxxxx.pkg"

Example of Required Self Service Description

alt text

Example of Factory Reset Self Service Description

alt text

Example of HUD Displayed if Installer is Downloaded

alt text

Example of FullScreen Dialog

alt text

Example of Utility Dialog

alt text

You can’t perform that action at this time.