Ensure Install of macOS Updates Is Enabled

MediumLevel 1Automatedmacos

Description

Ensure that macOS updates are installed after they are available from Apple. This setting enables macOS updates to be automatically installed. Some environments will want to approve and test updates before they are delivered. It is best practice to test first where updates can and have caused disruptions to operations.

How it is checked

Audit method: Shell command

shell

/usr/bin/osascript -l JavaScript <<'EOS'
$.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate').objectForKey('AutomaticallyInstallMacOSUpdates').js
EOS

Expected output: true

How it is fixed

Fix method: Guidance or infrastructure patch

Profile (preferred): com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates = <true/>. Terminal: sudo /usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -bool TRUE. GUI: System Settings > General > Software Update > i > Set Install macOS updates to enabled > Done.

Properties

Operating systems: macos-26
Tags: macossoftware-update
Reference: CIS Apple macOS 26 Tahoe Benchmark v1.1.0 - 1.3 Ensure Install of macOS Updates Is Enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos