25 Sep Prevent Users from Installing macOS High Sierra using Ivanti Endpoint Security Suite 2017
Apple will release its next generation operating system macOS High Sierra, today, September 25, 2017. If as an organization you’re not quite ready to introduce macOS High Sierra into your environments, i.e. you’re still trying to figure out if your AV, VPN, and your other critical business applications are fully functioning with macOS High Sierra, you can use Ivanti Security Suite to temporarily block the installer from running. Going this route will give you the extra days/weeks you need to finish validating the OS without having to worry about who is going to install the update and be calling you tomorrow wondering why their VPN won’t work.
The process to block an application in Ivanti Security Suite is quite easy and should only take you a couple of minutes to setup your policy and get it deployed.
- Launch the Ivanti Console
- Go to Tools > Security and Compliance > Patch and compliance
- From the menu bar, select the first button that may be titled All Types, but could be Antivirus, Blocked applications, Custom definition, Driver, LANDESK update, Security threat, Software update, Spyware or Vulnerability. Select Blocked applications if not already selected.
- Expand out the Blocked applications (all items) menu tree
- Right click on the Block folder and Add File
- Insert “Install macOS High Sierra.app” or whatever the final name of the OS installer is. Currently, the developer beta is “Install macOS High Sierra Beta.app”
- Check the box at the bottom that says Mac and uncheck the Windows box.
- If you don’t want to block the installer globally, click on the Block Status tab at the tab and select which Scopes the restriction should be applied to.
- Click OK.
Now that you have the blocked app definition created, you need to make sure the Ivanti agent security scanner has been enabled for blocked app scanning. To validate this or to set this, go through the steps below:
- Go to Tools > Security and Compliance > Agent Settings
- From the All Agent Settings menu tree, click on Distribution and Patch
- Open the Distribution and Patch setting assigned to your Macs. If you have more than one, edit each one respectively.
- Go to the Scan Options section under Patch-only settings and make sure the Blocked applications checkbox is checked.
- Click Save
At this point, your machines will automatically receive the change and begin blocking the macOS installer the next time a security scan is initiated. If you created an entirely new Distribution and Patch setting, different from the one currently applied to the Mac, you’ll need to create a Change Agent Settings task.
- While still in the Agent Settings window, click on the Calendar/Clock icon, it’s the second one in the menu bar and then select Change Settings.
- Give your task an appropriate name, I named mine “Blocked Apps Agent Settings”
- Find Distribution and Patch from the list on the right hand side of the panel and click on the corresponding Keep agent’s current settings.
- Find your newly created Distribution and Patch setting and select it.
- Now set your desired Task Settings (policy, push, policy supported push) and desired portal settings (required, recommended,optional). I used a policy-supported push and required.
- Add in your Targets.
- Schedule your Change Settings task.
That’s it. Now, whenever someone attempts to launch the macOS Installer they’re going to get a nice Application Denied prompt like the one below.