Ensure Install of macOS Updates Is Enabled

СреднийУровень 1Автоматическаяmacos

Описание

Ensure that macOS updates are installed after they are available from Apple. This setting enables macOS updates to be automatically installed. Some environments will want to approve and test updates before they are delivered. It is best practice to test first where updates can and have caused disruptions to operations. Automatic updates should be turned off where changes are tightly controlled and there are mature testing and approval processes. Automatic updates should not be turned off simply to allow the administrator to contact users in order to verify installation. A dependable, repeatable process involving a patch agent or remote management tool should be in place before auto-updates are turned off. Patches need to be applied in a timely manner to reduce the risk of vulnerabilities being exploited.

Как проверяется

Метод проверки: Команда оболочки

shell

/usr/bin/osascript -l JavaScript <<'EOS'
function run() {
  let pref1 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.commerce').objectForKey('AutoUpdate'))
  let pref2 = ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('com.apple.SoftwareUpdate').objectForKey('AutomaticallyInstallAppUpdates'))
  if ( pref1 == 1 || pref2 == 1 ) {
    return("true")
  } else {
    return("false")
  }
}
EOS

Ожидаемый вывод: true

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Graphical Method: Perform the following steps to enable macOS updates to run automatically: 1. Open System Settings 2. Select General 3. Select Software Update 4. Select the i 5. Set Install macOS updates to enabled 6. Select Done Terminal Method: Run the following command to to enable automatic checking and installing of macOS updates: % /usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticallyInstallMacOSUpdates -bool TRUE Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.SoftwareUpdate 2. The key to include is AutomaticallyInstallMacOSUpdates 3. The key must be set to <true/>

Свойства

Операционные системы: macos-14
Теги: macospatchingsonoma
Источник: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 1.4 Ensure Install of macOS Updates Is Enabled

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target macos