Munki
ManagedInstalls
Munki settings
macOS
Configuration Keys (62)
Showing 62 of 62 keys
| Key | Type | Description | Default | Range |
|---|---|---|---|---|
SoftwareRepoURLstring | string | Base URL for Munki repository. | Default: "http://munki/repo" | Range: — |
PFC_SegmentedControl_0stringrequired | string | — | Default: — | Range: — |
ClientIdentifierstringClient Identifier | string | Identifier for Munki client. Usually is the same as a manifest name on the Munki server. If this is empty or undefined, Munki will attempt the following identifiers, in order: fully-qualified hostname, "short" hostname, serial number and finally, "site_default". | Default: — | Range: — |
ManagedInstallDirstringManaged Install Directory | string | Folder where Munki keeps its data on the client. | Default: "/Library/Managed Installs" | Range: — |
LocalOnlyManifeststringLocal Only Manifest | string | Defines the name of your LocalOnlyManifest. Setting this activates the feature. Unsetting it means Munki will remove the file on the next run. | Default: — | Range: — |
SuppressAutoInstallbooleanSuppress Auto Install | boolean | Munki will not automatically install or remove items. | Default: false | Range: — |
SuppressLoginwindowInstallbooleanSuppress Loginwindow Install | boolean | Munki will not install items while idle at the loginwindow except for those marked for unattended_install or unattended_uninstall. | Default: false | Range: — |
InstallAppleSoftwareUpdatesbooleanInstall Apple Software Updates | boolean | Install updates from an Apple Software Update server, in addition to "regular" Munki updates. Prior to Munki 7, this controlled whether Munki would notify about AND install Apple updates. With Munki 7+, only notification occurs; Apple updates must be installed manually with Apple's tools. | Default: false | Range: — |
AppleSoftwareUpdatesOnlybooleanInstall Apple Software Updates Only | boolean | Only install updates from an Apple Software Update server. No Munki repository is needed or used. No longer really useful in Munki 7+, since Munki 7 only notifies about Apple updates rather than installing them. | Default: false | Range: — |
Include Major OS Updates in Apple Software Updates | boolean | If true (and InstallAppleSoftwareUpdates is also true), include major OS updates when displaying/notifying about available Apple updates. If false (the default), major OS upgrades (for example, a Ventura upgrade offered while running Monterey) are filtered out. | Default: false | Range: — |
UnattendedAppleUpdatesbooleanUnattended Apple Updates | boolean | Updates that declare no "must-close" applications, or have one or more "must-close" applications, none of which is running, and do not require a logout or restart will be installed as part of a normal periodic background run without notifying the user. Does nothing useful in Munki 7+, since Apple updates are no longer installed by Munki. | Default: false | Range: — |
PerformAuthRestartsbooleanPerform FileVault Authorized Restarts | boolean | Munki will attempt to perform a filevault auth restart. | Default: false | Range: — |
RecoveryKeyFilestringFileVault Credentials Path | string | Absolute path to a plist file containing filevault credentials in key/value format. Used to perform auth restarts. | Default: — | Range: — |
EmulateProfileSupportbooleanEmulate Profile Support (Big Sur) | boolean | A bit of hack and not supported by Apple, it is disabled by default. To emulate profile installs, configuration profiles are read, and if they contain managed preferences, they are converted to MCX data that is added to a ComputerGroup in the local Open Directory store. Configuration profile payloads that are not managed preferences are ignored/skipped. Munki 7 drops all support for installation of Configuration Profiles, including support for Configuration Profile Emulation, so this preference has no effect in Munki 7+. | Default: — | Range: — |
SuppressUserNotificationbooleanSuppress Update Notifications | boolean | Managed Software Center will never notify the user of available updates. Managed Software Center can still be manually invoked to discover and install updates. | Default: false | Range: — |
SuppressStopButtonOnInstallbooleanSuppress Stop Button On Install | boolean | Managed Software Center will hide the stop button while installing or removing software, preventing users from interrupting the install. | Default: false | Range: — |
InstallRequiresLogoutbooleanRequire Logout for Installs & Uninstalls | boolean | Managed Software Center will require a logout for all installs or removals. | Default: false | Range: — |
ShowRemovalDetailbooleanShow Removal Detail | boolean | Managed Software Center will display detail for scheduled removals. | Default: false | Range: — |
Show Optional Installs For Higher OS Versions | boolean | Managed Software Center.app will show optional installs and updates that apply to macOS versions higher than the currently installed version. | Default: false | Range: — |
DaysBetweenNotificationsintegerDays Between Notifications | integer | Number of days between user notifications from Managed Software Center. Set to 0 to have Managed Software Center notify every time a background check runs if there are available updates. | Default: 1 | Range: 0 – — |
UseNotificationCenterDaysintegerUse Notification Center Days | integer | Number of days Notification Center notifications should be used before switching to launching Managed Software Center. | Default: 3 | Range: 0 – — |
MSCOfferToQuitBlockingAppsbooleanOffer To Quit Blocking Apps | boolean | If true, if there are any running blocking_applications for pending updates, a sheet will be displayed allowing the user to direct Managed Software Center to attempt to quit the blocking applications. | Default: false | Range: — |
Offer To Force Quit Blocking Apps | boolean | If this (and MSCOfferToQuitBlockingApps) is true, if a "polite" attempt to quit an application fails, a button to force quit the application will be displayed. If false or undefined, a message telling the user to manually quit the app is displayed instead. | Default: false | Range: — |
MSCOfferToUpdateOthersbooleanOffer To Update Others | boolean | If there is a mix of pending updates, some of which are blocked by open applications, and some that are not, and this preference is true (and so is MSCOfferToQuitBlockingApps), a button will be shown to allow users to proceed with updating the non-blocked updates. | Default: false | Range: — |
PackageVerificationModestringPackage Verification Mode | string | Controls how Munki verifies the integrity of downloaded packages. (none = No integrity check is performed, hash = Integrity check is performed if package info contains checksum information, hash_strict = Integrity check is performed, and fails if package info does not contain checksum information.) Defaults to hash. | Default: "hash" | Range: none, hash, hash_strict |
MSCAllowNotificationWindowbooleanAllowed Notification Window | boolean | If true, users can open the Managed Software Center settings window to specify allowed time windows for notifications. | Default: false | Range: — |
Allowed Notification Window Start | integer | The earliest hour that can be selected for allowed notifications. | Default: 0 | Range: 0 – 23 |
Allowed Notification Window End | integer | Only hours earlier than this can be selected (non-inclusive). | Default: 24 | Range: 0 – 24 |
FollowHTTPRedirectsstringFollow HTTP Redirects | string | Defines whether Munki will follow all, some or no redirects from the web server. (none = The default behaviour. No redirects are followed. https = Only redirects to URLs using HTTPS are followed. all = Redirects to both HTTP and HTTPS URLs are followed.) | Default: "none" | Range: none, https, all |
Additional HTTP Headers | array | This key provides the ability to specify custom HTTP headers to be sent with all curl() HTTP requests. | Default: — | Range: — |
HTTPHeaderstringHTTPHeader | string | An HTTP header in "Header: Value" format. | Default: — | Range: — |
IgnoreSystemProxiesbooleanIgnore System Proxies | boolean | HTTP and/or HTTPS proxies set system-wide will be ignored, connections will be made directly. | Default: false | Range: — |
DownloadRetriesintegerDownload Retries | integer | Number of times to retry a failed download. Valid values are 0-10. Set to 0 to disable retries. | Default: 0 | Range: 0 – 10 |
DownloadRetrySleepSecondsintegerDownload Retry Sleep Seconds | integer | How many seconds to wait between download retries. Valid values are 1-30. | Default: 10 | Range: 1 – 30 |
PackageURLstringBase Package URL | string | Base URL for Munki pkgs. Useful if your packages are served from a different server than your catalogs or manifests. | Default: — | Range: — |
CatalogURLstringBase Catalog URL | string | Base URL for Munki catalogs. Useful if your catalogs are served from a different server than your packages or manifests. | Default: — | Range: — |
ManifestURLstringBase Manifest URL | string | Base URL for Munki manifests. Useful if your manifests are served from a different server than your catalogs or manifests. | Default: — | Range: — |
IconURLstringBase Icon URL | string | Base URL for product icons. Useful if your icons are served from a different server or different directory than the default. | Default: — | Range: — |
ClientResourceURLstringBase Client Resource URL | string | Base URL for custom client resources for Managed Software Center. Useful if your resources are served from a different server or different directory than the default. | Default: — | Range: — |
ClientResourcesFilenamestringClient Resources Filename | string | Specific filename to use when requesting custom client resources. | Default: — | Range: — |
HelpURLstringHelp URL | string | URL to open/display when the user selects "Managed Software Center Help" from Managed Software Center's Help menu. | Default: — | Range: — |
LicenseInfoURLstringLicense Info URL | string | URL for Munki to query a webserver to determine if there are available seats for licensed software (or any software you wish to make available via optional_installs, yet control the number of deployed copies). | Default: — | Range: — |
SoftwareUpdateServerURLstringSoftware Update Server URL | string | Catalog URL for Apple Software Updates. If undefined or empty, Munki will use the same catalog that the OS uses when you run Apple's Software Update application or call /usr/sbin/softwareupdate. | Default: — | Range: — |
UseClientCertificatebooleanUse Client Certificate | boolean | Use an SSL client certificate when communicating with the Munki server. Requires an https:// URL for the Munki repo. | Default: false | Range: — |
Client Certificate Acceptable CAs | array | Acceptable client certificate issuing CA distinguished names. Meant to be used when a server does not advertise CA names. Values must use RFC 4514-style distinguished names like "CN=Munki Client CA,O=ExampleOrg". Requires UseClientCertificate to be true. | Default: — | Range: — |
DistinguishedNamestringDistinguished Name | string | — | Default: — | Range: — |
Use Client Certificate CN As Client Identifier | boolean | Use the CN of the client certificate as the Client Identifier. Used in combination with the UseClientCertificate key. | Default: false | Range: — |
ClientCertificatePathstringClient Certificate Path | string | Absolute path to a client certificate. There are 3 defaults for this key. Concatenated cert/key PEM file accepted. | Default: — | Range: — |
ClientKeyPathstringClient Key Path | string | Absolute path to a client private key. | Default: — | Range: — |
SoftwareRepoCAPathstringSoftware Repo CA Path | string | Path to the directory that stores your CA certificate(s). See the curl man page for more details on this parameter. | Default: — | Range: — |
Software Repo CA Certificate | string | Absolute path to your CA Certificate. | Default: — | Range: — |
LogFilestringLog File | string | Primary log is written to this file. Other logs are written into the same directory as this file. | Default: "/Library/Managed Installs/Logs/ManagedSoftwareUpdate.log" | Range: — |
LogToSyslogbooleanLog to Syslog | boolean | Log to syslog in addition to ManagedSoftwareUpdate.log. | Default: false | Range: — |
LoggingLevelintegerLogging Level | integer | Higher values cause more detail to be written to the primary log. | Default: 1 | Range: — |
MSULogEnabledbooleanLog Enabled | boolean | Log user actions in the GUI. | Default: false | Range: — |
MSUDebugLogEnabledbooleanDebug Log Enabled | boolean | Debug logging for Managed Software Center. | Default: false | Range: — |
required | string | — | Default: — | Range: — |
AccessKeystringAccess Key | string | Munki has a feature which enables Mac administrators to use middleware to change munki's HTTP request. S3-Auth uses this feature to create the HTTP headers necessary to authenticate to S3. AccessKey for S3 bucket. | Default: — | Range: — |
Regionstring | string | Munki has a feature which enables Mac administrators to use middleware to change munki's HTTP request. S3-Auth uses this feature to create the HTTP headers necessary to authenticate to S3. Region for S3 bucket. | Default: — | Range: — |
SecretKeystringSecret Key | string | Munki has a feature which enables Mac administrators to use middleware to change munki's HTTP request. S3-Auth uses this feature to create the HTTP headers necessary to authenticate to S3. SecretKey for S3 bucket. | Default: — | Range: — |
S3EndpointstringS3 Endpoint | string | Munki has a feature which enables Mac administrators to use middleware to change munki's HTTP request. S3-Auth uses this feature to create the HTTP headers necessary to authenticate to S3. S3 Endpoint for bucket. | Default: — | Range: — |
IgnoreMiddlewarebooleanIgnore Middleware | boolean | If true, Munki will ignore installed middleware. Useful for when moving away from middleware. | Default: false | Range: — |
Aggressive Update Notification Days | integer | This preference controls how many days after one or more pending updates are ignored that aggressive user notification begins. Setting this to 0 never triggers this aggressive behavior. | Default: 14 | Range: 0 – — |
CustomSidebarItemsarrayCustom Sidebar Items | array | Custom sidebar configuration for Managed Software Center, overriding the default Software/Categories/My Items/Updates sidebar. Each array item is a dict with 'title', 'icon' (an SF Symbol name), and 'page' (a munki:// URL) key. Requires macOS 11 or later. | Default: — | Range: — |
| dict | — | Default: — | Range: — | |
titlestringTitle | string | The display title of this sidebar item. | Default: — | Range: — |
iconstringIcon | string | The name of the SF Symbol to use as this sidebar item's icon. | Default: — | Range: — |
pagestringPage | string | The munki:// URL this sidebar item navigates to. | Default: — | Range: — |