Keys Corner

Using a Snow Leopard Server, (OS X 10.6.x) it seems that administrators have a problem if they have used Apple’s Managed Client for OS X (MCX) to provide software updates to their clients from their local server and then want to switch back to having the clients get the updates from Apple’s servers. The problem seems to lie with Apple’s Managed Preferences, which is part of MCX.

Here is what I understand happens, and a solution:

Apple allows system administrators to restrict which preferences and system settings a user on a local client may manage themselves. The restricted services are managed centrally by the system administrator. He does this by setting up one or more groups of clients or users which are managed by the server and the changing of these services by users on these computers may then be locked out by the administrator using the Workgroup Manager from the server.

If the administrator removes members from the group, the restrictions should cease to apply. At least that is what I and other users expect. That does not seem to be the case. This means that once the software update source has been changed to the local server, people have problems to reset the software update source to Apple’s own servers.

There are various solutions described in the Apple support forums, but you need to pay close attention – the way that the software update in MCX is managed changed for each recent version of OS X and none of the solutions I found works permanently for Snow Leopard.

Here is what I have found to work. The solution allows you to switch back to sourcing from the Apple servers, but seems to reset itself periodically, so that it wants to use the local server.

1. In the Workgroup Manager Set the preference for the Software Update for the group being managed to have an update frequency of “Never” and clear the field specifying the location of the software updates on the local server.
   
2. If you don’t have any other need to manage the clients using MCX, you need to delete the complete Managed Preferences directory at /Library/Managed Preferences/
   
   I used a user with administrator rights to do this, and was asked for my password before the files could be moved to the trash can.
3. I also removed the clients from the group defining which clients should be managed for the software update, managed in the Workgroup Manager.

If you have other managed preferences which you wish to keep, you will need to look for the specific files – identifiable by their names containing “system update” – which are associated with the System Update function.

Various forums recommend deleting the client cache ~/Library/Caches/com.apple.softwareupdate and ~/Library/Preferences/com.apple.SoftwareUpdate.plist but deleting these alone didn’t help in my case under Snow Leopard.

If I find out what needs deleting to stop the source reverting periodically to the local server, I will update this note.

Additional Notes:
Finding information about MCX is not easy – it is not covered in the Apple Technical Documentation for OS X Server.
There is an introduction to MCX in Mac Tech here. It was written for OS X 10.5 (Leopard), so is reasonably up to date.
There is an older article introducing MCX also in MacTech here.