Munki

Base URL for Munki repository.

Default: "http://munki/repo"

Identifier for Munki client. Usually is the same as a manifest name on the Munki server. If this is empty or undefined, Munki will attempt the following identifiers, in order: fully-qualified hostname, "short" hostname, serial number and finally, "site_default".

Folder where Munki keeps its data on the client.

Default: "/Library/Managed Installs"

Defines the name of your LocalOnlyManifest. Setting this activates the feature. Unsetting it means Munki will remove the file on the next run.

Munki will not automatically install or remove items.

Default: false

Munki will not install items while idle at the loginwindow except for those marked for unattended_install or unattended_uninstall.

Default: false

Install updates from an Apple Software Update server, in addition to "regular" Munki updates.

Default: false

Only install updates from an Apple Software Update server. No Munki repository is needed or used.

Default: false

Updates that declare no "must-close" applications, or have one or more "must-close" applications, none of which is running, and do not require a logout or restart will be installed as part of a normal periodic background run without notifying the user.

Default: false

Munki will attempt to perform a filevault auth restart.

Default: false

Absolute path to a plist file containing filevault credentials in key/value format. Used to perform auth restarts.

A bit of hack and not supported by Apple, it is disabled by default. To emulate profile installs, configuration profiles are read, and if they contain managed preferences, they are converted to MCX data that is added to a ComputerGroup in the local Open Directory store. Configuration profile payloads that are not managed preferences are ignored/skipped.

Managed Software Center will never notify the user of available updates.

Default: false

Managed Software Center will hide the stop button while installing or removing software, preventing users from interrupting the install.

Default: false

Managed Software Center will require a logout for all installs or removals.

Default: false

Managed Software Center will display detail for scheduled removals.

Default: false

Managed Software Center.app will show optional installs and updates that apply to macOS versions higher than the currently installed version.

Default: false

Number of days between user notifications from Managed Software Center. Set to 0 to have Managed Software Center notify every time a background check runs if there are available updates.

Default: 1

Range: 0 – —

Number of days Notification Center notifications should be used before switching to launching Managed Software Center.

Default: 3

Range: 0 – —

If true, if there are any running blocking_applications for pending updates, a sheet will be displayed allowing the user to direct Managed Software Center to attempt to quit the blocking applications.

Default: false

If this (and MSCOfferToQuitBlockingApps) is true, if a "polite" attempt to quit an application fails, a button to force quit the application will be displayed.

Default: false

If there is a mix of pending updates, some of which are blocked by open applications, and some that are not, and this preference is true (and so is MSCOfferToQuitBlockingApps), a button will be shown to allow users to proceed with updating the non-blocked updates.

Default: false

Controls how Munki verifies the integrity of downloaded packages. (none = No integrity check is performed, hash = Integrity check is performed if package info contains checksum information, hash_strict = Integrity check is performed, and fails if package info does not contain checksum information.)

Range: none, hash, hash_strict

If true, users can open the Managed Software Center settings window to specify allowed time windows for notifications.

Default: false

The earliest hour that can be selected for allowed notifications.

Default: 0

Range: 0 – 23

Only hours earlier than this can be selected (non-inclusive).

Default: 24

Range: 0 – 24

Defines whether Munki will follow all, some or no redirects from the web server. (none = The default behaviour. No redirects are followed. https = Only redirects to URLs using HTTPS are followed. all = Redirects to both HTTP and HTTPS URLs are followed.)

Range: none, https, all

This key provides the ability to specify custom HTTP headers to be sent with all curl() HTTP requests.

HTTP and/or HTTPS proxies set system-wide will be ignored, connections will be made directly.

Default: false

Number of times to retry a failed download. Valid values are 0-10. Set to 0 to disable retries.

Default: 0

Range: 0 – 10

How many seconds to wait between download retries. Valid values are 1-30.

Default: 10

Range: 1 – 30

Base URL for Munki pkgs. Useful if your packages are served from a different server than your catalogs or manifests.

Base URL for Munki catalogs. Useful if your catalogs are served from a different server than your packages or manifests.

Base URL for Munki manifests. Useful if your manifests are served from a different server than your catalogs or manifests.

Base URL for product icons. Useful if your icons are served from a different server or different directory than the default.

Base URL for custom client resources for Managed Software Center. Useful if your resources are served from a different server or different directory than the default.

Specific filename to use when requesting custom client resources.

URL to open/display when the user selects "Managed Software Center Help" from Managed Software Center's Help menu.

URL for Munki to query a webserver to determine if there are available seats for licensed software (or any software you wish to make available via optional_installs, yet control the number of deployed copies).

Catalog URL for Apple Software Updates. If undefined or empty, Munki will use the same catalog that the OS uses when you run Apple's Software Update application or call /usr/sbin/softwareupdate.

Use an SSL client certificate when communicating with the Munki server. Requires an https:// URL for the Munki repo.

Default: false

Use the CN of the client certificate as the Client Identifier. Used in combination with the UseClientCertificate key.

Default: false

Absolute path to a client certificate. There are 3 defaults for this key. Concatenated cert/key PEM file accepted.

Absolute path to a client private key.

Path to the directory that stores your CA certificate(s).

Absolute path to your CA Certificate.

Primary log is written to this file. Other logs are written into the same directory as this file.

Default: "/Library/Managed Installs/Logs/ManagedSoftwareUpdate.log"

Log to syslog in addition to ManagedSoftwareUpdate.log.

Default: false

Higher values cause more detail to be written to the primary log.

Default: 1

Log user actions in the GUI.

Default: false

Debug logging for Managed Software Center.

Default: false

Munki has a feature which enables Mac administrators to use middleware to change munki's HTTP request. S3-Auth uses this feature to create the HTTP headers necessary to authenticate to S3. AccessKey for S3 bucket.

Munki has a feature which enables Mac administrators to use middleware to change munki's HTTP request. S3-Auth uses this feature to create the HTTP headers necessary to authenticate to S3. Region for S3 bucket.

Munki has a feature which enables Mac administrators to use middleware to change munki's HTTP request. S3-Auth uses this feature to create the HTTP headers necessary to authenticate to S3. SecretKey for S3 bucket.

Munki has a feature which enables Mac administrators to use middleware to change munki's HTTP request. S3-Auth uses this feature to create the HTTP headers necessary to authenticate to S3. S3 Endpoint for bucket.

If true, Munki will ignore installed middleware. Useful for when moving away from middleware.

Default: false

This preference controls how many days after one or more pending updates are ignored that aggressive user notification begins. Setting this to 0 never triggers this aggressive behavior.

Default: 14

Range: 0 – —