Cloud Secure Edge Docs
Auto Update
On This Page
Auto Update Overview
Auto Update assesses whether a device installs new versions of its operating system automatically. The point of the factor is to keep devices off operating system versions with known vulnerabilities, so the app looks at whether updates install, not only whether the device checks for them. A device that checks for updates and then waits for a person to click Install does not satisfy the factor. Which updates have to install automatically depends on the operating system, so read the collection rules for the operating system you support.
How to add Auto Update as a Trust Factor
In the Command Center, navigate from Trust > Profiles.
Either select an existing Trust Profile or create a new one.
Under the Trust Factors tab, select + Add Trust Factors if creating a new Trust Profile; select Edit and then +Add Trust Factors if adding new Trust Factors to an existing Trust Profile. Select Auto Update.
Set the Trust Effect.
How Cloud Secure Edge Collects the Auto Update Trust Factor
| OS | Command Input | Expected Output |
|---|---|---|
| macOS | The app reads five keys from /Library/Preferences/com.apple.SoftwareUpdate.plist. See macOS. | 1 for CriticalUpdateInstall | |
| Windows (v.4.7.0 and later) | The app calls IAutomaticUpdatesSettings::get_NotificationLevel. | 4 |
| Windows (pre v.4.7.0) | echo (New-Object -com Microsoft.Update.AutoUpdate).Settings.NotificationLevel | 4 |
| Linux | cat /etc/apt/apt.conf.d/10periodic and cat /etc/apt/apt.conf.d/20auto-upgrades |
macOS #
On macOS the app does not read a single setting. It reads five keys from /Library/Preferences/com.apple.SoftwareUpdate.plist and reports each one to the Command Center as its own field.
| Property list key | Reported as | What it controls | Value when the key is absent from the file |
|---|---|---|---|
AutomaticallyInstallMacOSUpdates | updates_install_enabled | Installing macOS updates without a person approving them | false |
CriticalUpdateInstall | updates_install_critical_enabled | Installing security responses and critical updates | true |
AutomaticCheckEnabled | updates_check_enabled | Checking Apple for available updates | true |
AutomaticDownload | updates_download_enabled | Downloading an available update in the background | true |
ConfigDataInstall | updates_install_system_enabled | Installing system data files | true |
Two rules in that table surprise people, so read the last column carefully:
AutomaticallyInstallMacOSUpdatescounts asfalsewhen the key is missing, because macOS ships with full automatic macOS installs turned off.- The other four keys count as
truewhen the key is missing, because macOS ships with those turned on. macOS writes a key into the file only once something changes the setting, so a missing key means the device still holds the Apple default.
CriticalUpdateInstall is the key that decides the result. Security responses and critical updates are what close known operating system vulnerabilities, so a macOS device satisfies Auto Update when critical updates install automatically. Full macOS version installs are not required.
Why a macOS device can pass with AutomaticallyInstallMacOSUpdates set to 0 #
Running this command on a device returns the state of one key, not the result of the Trust Factor:
defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticallyInstallMacOSUpdates
0 means false and 1 means true. A device that returns 0 has turned off unattended installs of full macOS versions. That device still satisfies Auto Update as long as CriticalUpdateInstall is enabled, which it is by default. To see every value the app actually used, check the desktop app logs for the New Features entry, which lists all five updates_ fields.