This is blog post from the work done by Kevin Saye...
Unlike Windows clients and servers, Microsoft does not provide "Windows Update" for Apple products. This article discusses how to configure System Center Configuration manager 2012 SP1 to leverage the Apple "Software Update" feature to ensure that Macs are up to date, as defined by Apple.
Using the Configuration Manager client for Mac and "Compliance Settings" (formerly called Desired Configuration Manager), we can configure "Windows Update" like functionality. The diagram below shows the components and dependencies. Notice how we use the client to check and verify updates with Apple's site directly, which is different from our architecture with Windows Update, where Configuration Manager talks (and downloads) updates from Windows Update.
The steps used by this solution are:
You can also configure a deployment that targets non complaint Macs, and the update can simply run the "/usr/sbin/softwareupdate" command with an install switch.
For this article, I will assume you have the Configuration Manager Environment setup and the Mac client deployed. There are numerous TechNet articles that discuss this.
A few items of note:
To start with, we will look at a Mac without the baseline installed.
Notice that there is not a /etc/crontab file which is the default. Also, if I run the softwareupdate –l command, we see that there are 2 updates that are recommended.
Once I applied the Baseline, I can go to the client and click Connect Now, the baseline will be applied to my system.
Notice now that even though the baseline is applied, it is showing non-compliant because the /tmp/softwareupate.log file is missing. We are waiting on cron to run and check with Apple.
Once cron has run and the baseline has run, it shows me that my Mac is missing 2 recommended updates, which is what I wanted.
Lastly, once cron runs, the /tmp/softwareupdate.log file looks like this:
And Configuration Manager shows compliance: