10.10 Yosemite Archives - Mr. Macintosh

Can I Upgrade or Downgrade macOS? Every Mac From 2006-2020

MrMacintosh.com - Can I upgrade or downgrade macOS? What is the minimum or maximum macOS Version my Mac can run? A full index of every Mac from 2006-2020 — What is the minimum and maximum macOS Version my Mac can run?

Do you need to downgrade or upgrade macOS on your Mac? This page will show you the oldest and newest version of macOS that you can install on your Mac.

Can I upgrade or downgrade macOS? How many times has this question come up over the years? Probably hundreds if not thousands of times. Mac Hardware has a minimum and maximum version of macOS that can be installed. MacOS versions that come before or after the minimum and maximum listed OS do not have the correct drivers required. At a certain point Apple will decide that a Mac is no longer supported and will not include drivers.

Internet Recovery Version

If your Mac supports Internet Recovery, you can use this guide to find out which version of macOS you will get using the following options.

Newest OS – Option-⌘-R

This option will be the newest or latest version of macOS that can be installed on your Mac.

Shipping OS (Oldest OS Available) – Shift-Option-⌘-R

The “Shipping OS Version” is the macOS version that your Mac originally shipped with from the factory. This is the IR Version that you will see if you use Shift-Option-⌘-R.

NOTE! The “Shipping OS can change to a newer OS release as the hardware gets older. An example of this is a MacBook Pro released with 10.13 but later is shipped with 10.14.

Fun Hardware Info

As of 5/1/321, Apple has released over 150 different Intel Model Identifiers.

Most Supported Mac =

MacBookPro9,1 (15-inch Mid 2012) – 10.7.3 – 10.15 = 9 OS Versions

Least Supported Mac =

MacBook1,1 (13-inch Core Duo 2006) – 10.4.6 – 10.6.8 = 3 OS Versions

Updates

In the future when Apple releases new hardware or OS, I will update this page. You can keep track of future updates from my Twitter Account @ClassicII_MrMac using the hashtag –

#UpgradeorDowngradeMacOS

Index of Intel-Based Mac Hardware From (2006-2020)

1. MacBook Pro – (2006-2020)
2. MacBook Air – (2008-2020)
3. MacBook – (2006-2017)
4. Mac Pro – (2006-2019)
5. iMac – (2006-2020)
6. iMac Pro – (2017)
7. Mac Mini – (2006-2018)
8. Xserve – (2006-2009)

1. MacBook Pro (2006-2020)

The MacBook Pro was introduced by Steve Jobs at Macworld Conference & Expo on January 10th, 2006. The MacBook Pro has seen five redesigns over the last 15 years. Starting with Gen 1 (2006-2008), Gen 2 Unibody (2008-2012), Gen 3 Retina (2012-2015), Gen 4 Touch Bar (2016-2019) & Gen 5 16″ Scissor (2019).

Model Identifier	Machine Model	T1 T2	Ship OS	Oldest OS	Latest OS
MacBookPro16,2	(13-inch 2020)	T2	10.15.4	10.15 >	11.0 >
MacBookPro16,2	(13-inch 2020)	T2	10.15.4	10.15 >	11.0 >
MacBookPro16,1	(16-inch Late 2019)	T2	10.15.1	10.15 >	11.0 >
MacBookPro15,4	(13-inch Mid 2019)	T2	10.14.5	10.14.6	11.0 >
MacBookPro15,1	(15-inch 2019)	T2	10.14.5	10.14.6	11.0 >
MacBookPro15,3	(15-inch 2019 Vega)	T2	10.14.5	10.14.6	11.0 >
MacBookPro15,3	(15″ Mid 2018 Vega)	T2	10.14.1	10.14.6	11.0 >
MacBookPro15,2	(13-inch Mid 2018)	T2	10.13.6	10.13.6	11.0 >
MacBookPro15,1	(15-inch Mid 2018)	T2	10.13.6	10.13.6	11.0 >
MacBookPro14,3	(15-inch Mid 2017)	T1	10.12.5	10.12.6	11.0 >
MacBookPro14,2	(13-inch Mid 2017)	T1	10.12.5	10.12.6	11.0 >
MacBookPro14,1	(13-inch Mid 2017)	T1	10.12.5	10.12.6	11.0 >
MacBookPro13,3	(15-inch Late 2016)	T1	10.12.1	10.12.6	11.0 >
MacBookPro13,2	(13-inch Late 2016)	T1	10.12.1	10.12.6	11.0 >
MacBookPro13,1	(15-inch Late 2016)	T1	10.12.1	10.12.6	11.0 >
MacBookPro11,5	(15-inch Mid 2015)		10.10.3	10.10.5	11.0 >
MacBookPro11,4	(15-inch Mid 2015)		10.10.3	10.10.5	11.0 >
MacBookPro12,1	(13-inch Early 2015)		10.10.2	10.10.5	11.0 >
MacBookPro11,3	(15-inch Mid 2014)		10.9.4	10.9.5	11.0 >
MacBookPro11,2	(15-inch Late 2013)		10.9.0	10.9.5	11.0 >
MacBookPro11,1	(13-inch Late 2013)		10.9.0	10.9.5	11.0 >
MacBookPro10,2	(13-inch Early 2013)		10.8.2	10.8.5	10.15 >
MacBookPro10,1	(15-inch Early 2013)		10.8.2	10.8.5	10.15 >
MacBookPro10,2	(13-inch Ret 2012)		10.7.4	10.7.5	10.15 >
MacBookPro10.1	(15-inch Ret 2012)		10.7.4	10.7.5	10.15 >
MacBookPro9,2	(13-inch Mid 2012)		10.7.3	10.7.5	10.15 >
MacBookPro9,1	(15-inch Mid 2012)		10.7.3	10.7.5	10.15 >
MacBookPro8,3	(17-inch Late 2011)		10.7.2	10.7.5	10.13.6
MacBookPro8,2	(15-inch Late 2011)		10.7.2	10.7.5	10.13.6
MacBookPro8,1	(13-inch Late 2011)		10.7.2	10.7.5	10.13.6
MacBookPro8,3	(17-inch Early 2011)		10.6.6	10.6.6*	10.13.6
MacBookPro8,2	(15-inch Early 2011)		10.6.6	10.6.6*	10.13.6
MacBookPro8,1	(13-inch Early 2011)		10.6.6	10.6.6*	10.13.6
MacBookPro7,1	(13-inch Mid 2010)		10.6.3	10.6.3*	10.13.6
MacBookPro6,2	(15-inch Mid 2010)		10.6.3	10.6.3*	10.13.6
MacBookPro6,1	(17-inch Early 2010)		10.6.3	10.6.3*	10.12.6
MacBookPro5,5	(13-inch Mid 2009)		10.5.7	10.5.7*	10.11.6
MacBookPro5,4	(15-inch Mid 2009)		10.5.7	10.5.7*	10.11.6
MacBookPro5,3	(15-inch Mid 2009)		10.5.7	10.5.7*	10.11.6
MacBookPro5,2	(17-inch Early 2009)		10.5.6	10.5.6*	10.11.6
MacBookPro5,1	(15-inch Late 2008)		10.5.5	10.5.5*	10.11.6
MacBookPro5,1	(17-inch Late 2008)		10.5.5	10.5.5*	10.11.6
MacBookPro4,1	(15-inch Early 2008)		10.5.2	10.5.2*	10.11.6
MacBookPro4,1	(17-inch Early 2008)		10.5.2	10.5.2*	10.11.6
MacBookPro3,1	(15-inch Late 2007)		10.4.9	10.4.9*	10.11.6
MacBookPro3,1	(17-inch Late 2007)		10.4.9	10.4.9*	10.11.6
MacBookPro2,2	(15-inch Late 2006)		10.4.8	10.4.8*	10.7.5
MacBookPro2,1	(17-inch Late 2006)		10.4.8	10.4.8*	10.7.5
MacBookPro1,2	(17-inch 2006)		10.4.5	10.4.5*	10.6.8
MacBookPro1,1	(15-inch 2006)		10.4.5	10.4.5*	10.6.8
*Available on	Reinstall DVD or CD

2. MacBook Air (2008-2020)

The MacBook Air was first introduced at Macworld San Fransisco by Steve Jobs on January 15th, 2008. For the 1st Generation from 2008-2010 the screen size was or a 13.3″ and included a Intel Core 2 Duo Processor. The Second Generation introduced in 2010 added an 11″ version. From 2017 on you could only get the 13″ Model. The 3rd Generation 13-inch MacBook Air was released in 2018.

Model Identifier	Machine Model	T1 T2	Ship OS	Oldest OS	Latest OS
MacBookAir9,1	(Retina, 13-inch, 2020)	T2	10.15.3	10.15>	10.15>
MacBookAir8,2	(Retina, 13-inch, 2019)	T2	10.14.5	10.14.6	10.15>
MacBookAir8,1	(Retina, 13-inch, 2018)	T2	10.14.1	10.14.6	10.15>
MacBookAir7,2	(Mid 2017)		10.12.6	10.12.6	10.15>
MacBookAir7,2	(13-inch Early 2015)		10.10.2	10.10.5	10.15>
MacBookAir7,1	(11-inch Early 2015)		10.10.2	10.10.5	10.15>
MacBookAir6,2	(13-inch Early 2014)		10.10.2	10.10.5	10.15>
MacBookAir6,1	(11-inch Mid 2013)		10.8.4	10.8.5	10.15 >
MacBookAir6,2	(13-inch Mid 2013 )		10.8.4	10.8.5	10.15 >
MacBookAir6,1	(11-inch Mid 2012)		10.7.4	10.7.5	10.15 >
MacBookAir5,2	(13″ EDU Mid 2012)		10.8.2	10.8.5	10.15 >
MacBookAir5,2	13-inch Mid 2012)		10.7.4	10.7.4*	10.15>
MacBookAir5,1	(11-inch Mid 2012)		10.7.4	10.7.4*	10.15 >
MacBookAir4,2	(13″ EDU Mid 2012)		10.7.3	10.7.4*	10.15 >
MacBookAir4,1	(11-inch Mid 2012)		10.7	10.7.4*	10.15 >
MacBookAir3,2	(13-inch Late 2010)		10.6.4	10.6.4*	10.13.6
MacBookAir3,1	(11-inch Late 2010)		10.6.4	10.6.4*	10.13.6
MacBookAir2,1	(13-inch Mid 2009)		10.5.7	10.5.7	10.11.6
MacBookAir2,1	(13-inch Late 2008)		10.5.5	10.5.5	10.11.6
MacBookAir1,1	(13-inch Early 2008)		10.5.1	10.5.1	10.11.6
*USB Installer

3. MacBook – (2006-2017)

This Section covers the original 2006 13-inch MacBook all the way to the 2017 12″ Version. The MacBook has seen 4 different designs since 2006. Gen 1 Polycarbonate (2006-2008), Gen 2 Aluminum Unibody (2008-2009). Gen 3 Polycarbonate Unibody (2009-2010) & Gen 4 12″ USB-C (2015-2017).

Model Identifier	Machine Model	Ship OS	Oldest OS	Latest OS
MacBook10,1	(Mid 2017)	10.12.5	10.12.6	10.15 >
MacBook9,1	(Early 2016)	10.11.4	10.11.6	10.15 >
MacBook8,1	(Early 2015)	10.10.2	10.10.6	10.15 >
MacBook7,1	(Unibody Mid 2010)	10.6.3	10.6.3 DVD	10.11.6
MacBook6,1	(Unibody Late 2009)	10.6.1	10.6.1 DVD	10.13.6
MacBook5,2	(White Mid 2009)	10.5.7	10.5.7 DVD	10.11.6
MacBook5,2	(13-inch C2D Early 2009)	10.5.6	10.5.6 DVD	10.11.6
MacBook5,1	(13-inch C2D Late 2008 Aluminum)	10.5.5	10.5.5 DVD	10.11.6
MacBook4,1	(13-inch C2D Early 2008)	10.5.2	10.5.2 DVD	10.7.5
MacBook3,1	(13-inch C2D Late 2007)	10.5	10.5 DVD	10.7.5
MacBook2,1	(13-inch C2D Mid 2007)	10.4.9	10.4.9 DVD	10.7.5
MacBook2,1	(13-inch C2D Late 2006)	10.4.8	10.4.8 DVD	10.7.5
MacBook1,1	(13-inch Core Duo 2006)	10.4.6	10.4.6 DVD	10.6.8

4. Mac Pro – (2006-2019)

The Mac Pro was first introduced at WWDC on August 7, 2006. It has seen 3 Generations from 2006-2019. Gen 1 “Cheese Grater” V1 (2006-2012), Gen 2 “Trash Can” (2013) & Gen 3 “Cheese Grater” V2 (2019).

Model Identifier	Machine Model	T1 T2	Ship OS	Oldest OS	Latest OS
MacPro7,1	(2019)	T2	10.5.1	10.15 >	10.15 >
MacPro6,1	(Late 2013)	NA	10.9.1	10.9.5	10.15 >
MacPro5,1	(2012 Server)	NA	10.7.4	10.7.5	10.14.6*
MacPro5,1	(Mid 2010)	NA	10.6.4	10.6.4 DVD	10.14.6*
MacPro4,1	(Nehalem 2009)	NA	10.5.6	10.6.6 DVD	10.11.6
MacPro3,1	(Eight Core 2008)	NA	10.5.1	10.5.1 DVD	10.11.6
MacPro2,1	(Eight Core 2007)	NA	10.4.9	10.4.9 DVD	10.7.5
MacPro1,1	(Quad Core 2006)	NA	10.4.7	10.4.7 DVD	10.7.5
*Metal Graphics	Video Card Required

5. iMac – (2006-2019)

The iMac was first introduced at an Apple Special Event at the Flint Center, Cupertino on May 6, 1998 by Steve Jobs. The First Intel Based iMac was introduced at Macworld Conference and Expo on January 10, 2006 by Steve Jobs. It has seen seven different designs since 1998.

Model Identifier	Machine Model	Ship OS	Oldest OS	Latest OS
iMac20,2	(5K, 2020; 5700/XT)	10.15.6	10.15.6	10.15>
iMac20,1	(27-Inch 5K, 2020)	10.15.6	10.15.6	10.15>
iMac19,2	(21.5-Inch 4k, 2019)	10.14.4	10.14.6	10.15 >
iMac19,1	(27-Inch 5k, 2019)	10.14.4	10.14.6	10.15 >
iMac18,3	(27-Inch 5k Mid-2017)	10.12.4	10.12.6	10.15 >
iMac18,2	(21.5-Inch 4k Mid-2017)	10.12.4	10.12.6	10.15 >
iMac18,1	(21.5-Inch Mid-2017)	10.12.4	10.12.6	10.15 >
iMac17,1	(27-Inch 5k, Late 2015)	10.11	10.11.6	10.15 >
iMac16,2	(21.5-Inch 4k. Late 2015)	10.11	10.11.6	10.15 >
iMac16,2	(21.5-Inch Late 2015)	10.11	10.11.6	10.15 >
iMac16,1	(21.5-Inch Late 2015)	10.11	10.11.6	10.15 >
iMac15,1	(27-Inch 5K, Mid-2015)	10.10.2	10.10.5	10.15 >
iMac15,1	(27-Inch 5k, Late 2014)	10.10	10.10.5	10.15 >
iMac14,4	(21.5-inch Mid 2014)	10.9.3	10.9.5	10.15 >
iMac14,3	(21.5-inch Late 2013)	10.8.4	10.8.5	10.15 >
iMac14,2	(27-inch Late 2013)	10.8.4	10.8.5	10.15 >
iMac14,1	(21.5-inch Late 2013)	10.8.4	10.8.5	10.15 >
iMac13,2	(27-Inch Late 2012)	10.8.2	10.8.5	10.15 >
iMac13,1	(21.5-inch Late 2012)	10.8.2	10.8.5	10.15 >
iMac12,1	(21.5-inch Late 2011)	10.7.2	10.7.5	10.13.6
iMac12,2	(27-inch Mid 2011)	10.6.6	10.6.6 DVD	10.13.6
iMac12,1	(21.5-inch Mid 2011)	10.6.6	10.6.6 DVD	10.13.6
iMac11,3	(27-inch Mid 2010)	10.6.3	10.6.3 DVD	10.13.6
iMac11,2	(21.5-inch Mid 2010)	10.6.3	10.6.3 DVD	10.13.6
iMac11,1	(27-inch Late 2009)	10.6.2	10.6.2 DVD	10.13.6
iMac10,1	(21.5-inch Late 2009)	10.6.1	10.6.1 DVD	10.13.6
iMac10,1	(27-inch Late 2009)	10.6.1	10.6.1 DVD	10.13.6
iMac9,1	(20-inch Mid 2009 EDU)	10.5.8	10.5.8 DVD	10.11.6
iMac9,1	(24-inch Early 2009)	10.5.6	10.5.6 DVD	10.11.6
iMac9,1	(20-inch Early 2009)	10.5.6	10.5.6 DVD	10.11.6
iMac8,1	(24-inch Early 2008)	10.5.2	10.5.2 DVD	10.11.6
iMac8,1	(20-inch Early 2008)	10.5.2	10.5.2 DVD	10.11.6
iMac7,1	(24-inch Mid 2007)	10.4.10	10.4.10 DVD	10.11.6
iMac7,1	(20-inch Mid 2007)	10.4.10	10.4.10 DVD	10.11.6
iMac6,1	(24-inch Late 2006)	10.4.7	10.4.7 DVD	10.7.5
iMac5,2	(17-inch Late 2006)	10.4.7	10.4.7 DVD	10.7.5
iMac5,1	(20-inch Late 2006)	10.4.7	10.4.7 DVD	10.7.5
iMac5,1	(17-inch Late 2006)	10.4.7	10.4.7 DVD	10.7.5
iMac4,2	(17-inch Mid 2006)	10.4.7	10.4.7 DVD	10.6.8
iMac4,1	(20-inch Early 2006)	10.4.4	10.4.4 DVD	10.6.8
iMac4,1	(17-inch Early 2006)	10.4.4	10.4.4 DVD	10.6.8

6. iMac Pro (2018)

The iMac Pro was introduced at WWDC on June 5, 2017.

Model Identifier	Machine Model	T2	Ship OS	Oldest OS	Latest OS
iMacPro1,1	(5k, 27-inch Late 2017)	T2	10.13.2	10.13.6	10.15 >

7. Mac Mini – (2006 -2018)

On January 10, 2005, the Mac mini was announced at the Macworld Conference & Expo by Steve Jobs. He said at the time the Mac Mini was “the cheapest, most affordable Mac ever”. The Intel Version was announced on February 28, 2006.

Model Identifier	Machine Model	T1 T2	Shipping OS	Oldest OS	Latest OS
Macmini8,1	(Late 2018)	T2	10.14	10.14.6	10.15 >
Macmini7,1	(Late 2014)	NA	10.10	10.10.5	10.15 >
Macmini6,2	(Late 2012 Server)	NA	10.8.2	10.8.5	10.15 >
Macmini6,2	(Late 2012)	NA	10.8.1	10.8.5	10.15 >
Macmini6,1	(Late 2012)	NA	10.8.1	10.8.5	10.15 >
Macmini5,3	(Mid 2011 Server)	NA	10.7	10.7.5	10.13.6
Macmini5,2	(Mid 2011)	NA	10.7	10.7.5	10.13.6
Macmini5,1	(Mid 2011)	NA	10.7	10.7.5	10.13.6
Macmini4,1	(Mid 2010 Server)	NA	10.6.4	10.6.4 DVD	10.13.6
Macmini4,1	(Mid 2010)	NA	10.6.4	10.6.4 DVD	10.13.6
Macmini3,1	(Late 2009 Server)	NA	10.6.1	10.6.1 DVD	10.11.6
Macmini3,1	(Late 2009)	NA	10.6.1	10.6.1 DVD	10.11.6
Macmini3,1	(Early 2009)	NA	10.5.6	10.5.6 DVD	10.11.6
Macmini2,1	(Mid 2007)	NA	10.4.10	10.4.10 DVD	10.7.5
Macmini1,1	(Late 2006)	NA	10.4.7	10.4.7 DVD	10.6.8
Macmini1,1	(Early 2006)	NA	10.4.5	10.4.5 DVD	10.6.8

8. Xserve – (2006-2009)

I almost forgot about Xserve. How could I forget about one of my favorite most reliable Macs ever created? The Xserve was introduced on May 14, 2002. The First Generation was based on a G4 Processor. The 2nd Generation was based on the G5 and the 3rd and final Generation was based on Intel’s Xeon Processor.

Model Identifier	Machine Model	Shipping OS	Oldest OS	Latest OS
Xserve3,1	(Quad Core Early 2009)	10.5.6 Server	10.5.6 Server DVD	10.11.6
Xserve2,1	(Eight Core Early 2008)	10.5 Server	10.5.0 Server DVD	10.7.5
Xserve1,1	(Quad Core Late 2006)	10.4.8 Server	10.4.8 Server DVD	10.7.5

If you have information for this page or find an error, please Contact Me.

Thank You!

https://everymac.com is the best source for Macintosh Hardware information on the internet!

upgrade or downgrade macOS

Google Chrome Keystone is Removing /var symlink on non SIP Macs Causing Boot Issues

MrMacintosh.com - Google Chrome Keystone Updater is removing the /var symlink causing account and boot issues. — *Google Chrome Keystone Updater is removing the /var symlink causing account and boot issues.*

UPDATE: 10/03/19

Google has posted an update that they found the issue in the Keystone Update and fixed it. They are are pushing the updated version now. The push started last night and the new version should be 1.2.13.79 or 1.2.13.80.

Google has been able to reproduce the bug. Chromium bug – bugs.chromium.org/p/chromium/issues/detail?id=1007358

Google now is recommending that you reinstall macOS to fix the issue. support.google.com/chrome/thread/15235262

Statement From AVID 9/25- avid.com/92419issue

See Index #7 for the Updated Fix from Google Support

#Varsectomy FAQ- Index

1. What is going on here? – #Varsectomy
2. Which macOS Versions are affected ?
3. Specific Mac Hardware ?
4. SIP – System Integrity Protection
5. AVID or Google Chrome Keystone Update causing this issue ?
6. How can I check my /var symlink?
7. How can I fix the issue = 2 ways to fix.
8. What about Hackintosh users? A fix for you!
9. Should I disable Chrome Auto Updates
10. Jamf Pro Extension Atribute
11. Links
12. Credit – Investigation by #MacAdmins & Apple

1. What is going on here ? – #Varsectomy

The purpose of this article is to gather all known information and data around the current issues some AVID and NON SIP protected Macs are experiencing. The issue first started on Monday 9/23/19.

Late Yesterday some #MacAdmins started to report that a few of their systems would not boot properly. They would have the following issues.

1. After rebooting the affected system it would Kernel Panic. The system will reboot only to KP again
2. User Logs out and the system shows the Setup Assistant.
3. The System Kernel Panics into a boot Loop.

AVID users were some of the first to report the issue. AVID.com says

Avid empowers media creators with innovative technology and collaborative tools to entertain, inform, educate and enlighten the world.

Sometimes AVID Media Creators use 3rd Party Graphics cards connected to their Mac Pro. When the issue hit yesterday, it was thought that AVID was the main cause of the problems since all the users experiencing the issue had AVID software.

Only later after a MacAdmins deep dive investigation was it found that AVID was NOT the cause of the problem. It was Google Chrome Keystone Updater!

Join the #Varsectomy channel in MacAdmins Chat for the latest info!

2. Which macOS Versions are affected ?

MacOS 10.9 – 10.14 Mojave

NOTE: macOS 10.9 & 10.10 so not have SIP. System Integrity Protection was introduced in macOS 10.11 El Capitan.

3. Specific Mac Hardware ?

At first it was first reported that the 2013 Mac Pro was affected, this is not true.

Now it seems the issue affects all Macs that have SIP (System Integrity Protection) Disabled or turned OFF

Check if SIP is enabled by running csrutil status

System Integrity Protection status: enabled.
System Integrity Protection status: disabled

4. SIP – System Integrity Protection

All Reports so far look to be from Macs that have SIP Disabled!

Please do not disable SIP, it was created to protect macOS from this very issue.

5. AVID or Google Chrome Keystone Update causing this issue ?

At first the issue seemed to be caused by Avid Media Composer. After further investigation it was found that AVID was not the problem! Some AVID users may need to DISABLE SIP for 3rd party Video Card support.

After investigation from some of the top minds in the MacAmins Slack Chat #varsectomy channel it was found that the Google Keystone Updater was at the heart of the issue.

The Google Chrome Keystone updater lives here (if set to only update for the user who installed Chrome) – ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/

If set to install for ALL users. (This also prompts for admin access for install) Thanks Jeff Johnson /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/

You can run the Google Chrome Keystone Updater Manually to kick off an update check. (NOTE: Google has disabled the updater for now!) see bugs.chromium.org/p/chromium/issues/detail?id=1007358

~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runmode oneshot

Thank you eholtam for the VM investigation and Screenshots!

Google Chrome Keystone Update Policy Running.

After kicking off the update you can see the problem below.

Found and deleted symlink at path /var

6. How do I check my /var symlink?

Check to see if your /var symlink was modified by running the following command.

ls -ldO /var

You should get one of the following outputs. The first one below means that your /var volder is SIP protected (notice the restricted flag) and the proper sym link /var -> private/var

lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Apr 1 2018 /var -> private/var

The next one means that your symlink is broken and the folder is NOT SIP Protected.

drwxr-xr-x 5 503 wheel - 170 Sep 24 14:37 /var

If you find /var in this condition you are affected! If you LOGOUT, SHUTDOWN OR RESTART your Mac will NOT Boot! You will need to boot into recovery, repair the /var symlink and reset the restricted flags. Fix below.

7. How can I fix the issue? 2 ways to fix.

UPDATE: 9/25 – Rich Trouton posted a great article showing you step by step how to fix both 10.9-10.10 & 10.11-10.14 systems – derflounder.wordpress.com/2019/09/25/google-keystone-update-breaks-macs-ability-to-boot-if-system-integrity-protection-is-disabled/

1st Fix from MacAdmins User Juest

First you have to fix the /var symlink so it shows /var -> private/var

Then you can remove the affected LaunchAgents

Boot to macOS Recovery by holding down Command R

Steps for 10.11 -10.14 SIP Supported Systems

1. Boot into Recovery
2. Launch Terminal
(only if you're on 10.11+ with SIP)
# chroot /Volumes/[affected install] 
# mv var vv
# ln -s private/var var
# chflags -h restricted /var
# chflags -h hidden /var
# xattr -sw com.apple.rootless "" /var

Steps for 10.9-10.10 NON SIP Systems

10.10 or older:
only do symblink and the hidden chflag and 
remove launch agents from 
/Users/[affected user]/Library/LaunchAgents/
OR 
/Library/LaunchAgents/
- com.google.keystone.agent.plist
- com.google.keystone.xpcservice.plist
# exit
(recommended) # csrutil enable (10.11+)
8. Reboot

UPDATE: 9/28 – 2nd Fix is from Google Support

Google is now recommending that you reinstall macOS if you had this issue.
https://support.google.com/chrome/thread/15235262

NOTE: The information below is from Google. Link Below.

chroot /Volumes/Macintosh\ HD          #(Macintosh HD is the default)
rm -rf /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle
  mv var var_back               #(Var may not exist, but this is fine)      
  ln -sh private/var /var
  chflags -h restricted /var
  chflags -h hidden /var
  xattr -sw com.apple.rootless "" /var

NOTE: Commenter stockmind has noted that the GoogleSoftwareUpdate.Bundle could reside in the USERS folder. In that case you need to run this string instead. Change USERNAME to your Username. Thanks for the tip!

rm -rf /Users/USERNAME/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle

Official Fix from Google support.google.com/chrome/thread/15235262

news.ycombinator.com/item?id=21066472 & 9to5google.com/2019/09/24/avid-mac-crashing-google/

8. What about Hackintosh users? A fix for you!

I had a few Hackintosh users reach out for a fix. Good News! u/Fargo_Newb on Reddit has a fix for you. – reddit.com/r/hackintosh/comments/d8tm8z/psa_google_chrome_updaterkeystone_rendering/

9. Should I disable Chrome Auto Updates ?

You shouldn’t need to disable Chrome Auto updates at this time. From the Chromium bug report – bugs.chromium.org/p/chromium/issues/detail?id=1007358 Google has disabled Keystone updates for now until the issue is found and resolved.

If you would like to disable Google Chrome Keystone automatic updates, the article below will show you. applehelpwriter.com/2014/07/13/how-to-remove-googles-secret-update-software-from-your-mac/

10. Jamf Pro Extension Attribute

This will help you find machines that are in a state where the /var sys link is broken. Thanks @neilmartin83 & @rmanly

#!/bin/bash

if [[ -h /var ]]; then
    echo "<result>symlink</result>"
elif [[ -d /var ]]; then
    echo "<result>directory</result>"
fi

exit 0

symlink = System OK!

11. Links

Below are a few of of the reports. It first started out as “AVID Hollywood Mac Pro boot problem“.

Jeff Rosica AVID CEO statement early on 9/24.

Chromium Bug Report 9/25 – https://bugs.chromium.org/p/chromium/issues/detail?id=1007358

Google Official Response 9/25 & 9/27 – support.google.com/chrome/thread/15235262

Official AVID Statement 9/25 – avid.com/92419issue

Rich Trouton step by step fix guide 9/25 –derflounder.wordpress.com/2019/09/25/google-keystone-update-breaks-macs-ability-to-boot-if-system-integrity-protection-is-disabled/

Scott Simmons 9/24 – provideocoalition.com/avid-editors-editors-in-general-be-on-alert-about-this-potential-rebooting-issue/

SlashDot Report 9/26 – https://it.slashdot.org/story/19/09/25/2152236/mysterious-mac-pro-shutdowns-likely-caused-by-chrome-update

Ars Technica Report 9/26 – arstechnica.com/information-technology/2019/09/no-it-wasnt-a-virus-it-was-chrome-that-stopped-macs-from-booting/

Daring FireBall by John Gruber 9/26 – daringfireball.net/linked/2019/09/25/mr-macintosh-chrome-updater

Forbes Report 9/26 – forbes.com/sites/kateoflahertyuk/2019/09/26/google-confirms-buggy-chrome-update-is-breaking-apple-macs/#5aad7747391c

Hacker News Discussion Thread 9/25- news.ycombinator.com/item?id=21064663

Gizmodo.com Report 9/25 – gizmodo.com/whoops-google-says-mysterious-wave-of-unbootable-macs-1838430057

Hackintosh Fix 9/25 – reddit.com/r/hackintosh/comments/d8tm8z/psa_google_chrome_updaterkeystone_rendering/

Updated Report from 9to5google.com 9/25 – 9to5google.com/2019/09/24/avid-mac-crashing-google/

Variety Updated Report 9/25 – variety.com/2019/digital/news/mac-pro-avid-shutdowns-chrome-update-keystone-1203348549/

Variety Report 9/24- variety.com/2019/digital/news/avid-mac-pro-corrupted-hollywood-1203347033/

MacRumors Report 9/24 – macrumors.com/2019/09/24/hollywood-mac-pros-hit-by-avid-issue/

Bleeping Computer Report 9/24 –bleepingcomputer.com/news/software/avid-users-are-suddenly-finding-that-their-macs-won-t-boot/

Some of the first reports on the AVID FaceBook Group 9/24 – https://www.facebook.com/photo.php?fbid=10156759822188022&set=p.10156759822188022&type=3&theater

Disable Google Chrome Keystone Automatic Updates – applehelpwriter.com/2014/07/13/how-to-remove-googles-secret-update-software-from-your-mac/

12. Credit! – Further investigation by #MacAdmins & Apple

It needs to be stated that many MacAdmins and Apple Engineers worked together and after investigating with users who had the issue. Great work guys!!!

@rtrouton for the cool /var Logo!
@bradtchapman for #Varsectomy
@eholtam for investigation and screen shots.
@Juest for investigation and fix commands
All active users in MacAdmins Chat #varsectomy

3 Undocumented macOS Mojave 10.14 Enterprise Fixes

In this article, I will talk a little bit about the current state of Apple’s Documentation. After that, I will show you 3 Undocumented 10.14 Mojave fixes that can help you as a MacAdmin.

Documentation, Documentation, and Documentation. Say it three times fast! MacAdmins just want Apple to provide proper documentation for features, controls and security settings and Enterprise Fixes. In some cases, Apple provides excellent documentation. An example of this would be the T2 Security Chip Security Overview released in October of last year. In other cases when it comes to binaries like sysadminctl not so much.

I tried to searching for something that specifically mentions SecureToken or sysadminctl and came up empty.

The best that I could find was a document called “If you see authentication server errors when turning FileVault on in macOS High Sierra“. This article does not even mention SecureToken. You can get a few nuggets of information by checking the sysadminctl binary options but sysadminctl doesn’t have a man page. I even performed a search on developer.apple.com/documentation as you can see in the picture above. I will be writing about sysadminctl next week. Maybe I can create a MacAdmins version of a sysadmincatl man page! Yet when I search for “SmartCard” three documents show up. SmartCard support is a small piece in the overall macOS pie, yet has multiple documents! Side Note: Shout out to all my peeps in the MacAdmins.slack.com #SmartCard channel (about 5 people) 🙂

Documentation is getting better.

If you have been keeping track, Apple documentation is getting better. If you look at the “What’s new in the updates for macOS Mojave” page you will see a large number of fixes. Eagle eye MacAdmins will be first to spot “Enterprise Content”, this is the stuff MacAdmins are interested in.

10.14.2

10.14.3

10.14.4

Check out that first one under 10.14.4! As noted in my previous article, I fought to get that one fixed since 10.14.0. It’s really great to see that fix get mentioned in the Enterprise Content area.

What do you mean undocumented fixes ?

Apple is constantly fixing things behind the scenes. MacAdmins continue to file radars, call Apple Care, test beta releases, submit feedback and submit Apple Enterprise Support tickets. Defects and bugs ARE getting fixed but are not listed in Apple’s Enterprise Content listing. I am not totally sure why certain fixes do not make the list.

Maybe Apple wants to keep the list short while focusing on the major fixes. I wish Apple would list more of them, even if they posted them in an enterprise only area. An example of this would be AppleSeed for IT. If you are part of an Enterprise or School you can be selected to join the program. I highly recommend joining if you are not a member already. You can read the FAQ about joining eligibility here. Inside you will find links to macOS beta downloads and beta documentation. Each beta release (Sometimes up to 6 releases per combo update) will show what has been fixed between updates. This is great information for any MacAdmin to have so you can stay on top of what’s going on.

3 Apple Enterprise fixes included in 10.14.0 – 10.14.4

1. macOS 10.14 Mojave can now provide FV2 Authenticated Restarts for Combo and startOSinstalls.

In 10.14 macOS Updates and Upgrades are now able to perform Authorized Restarts. This feature was not an option in previous releases. This is a pretty big deal, especially for #MacEDU and Enterprise customers who have computer labs.

Previously if you installed a macOS update and the system was FV2 encrypted it would restart but STOP at the FV2 unlock screen. If you performed this update remotely you would lose control of the machine. Things get worse at FV2 login window because firmware will shut the Mac down after 5 minutes of inactivity. The same problem will happen when you start a macOS Upgrade. You will be disappointed after returning from lunch thinking the update is complete only to find the Mac turned OFF. You then power the Mac back on only to find the installer has just started with 40 minutes remaining. With 10.14 if you kick off a combo update or macOS upgrade the installer will perform an Authorized Restart and you will never get stuck at the FV2 prompt again!

For startosinstall you just have to store the mojave.app in a folder like /Users/Shared. Then kick it off with this command – sudo /Users/Shared/Install\ macOS\ Mojave.app/Contents/Resources/startosinstall –nointeraction The –nointeraction option will prevent license agreement message.

2. Installing software updates using the -R restart option at the login window now properly restarts the Mac to the installer. (10.14.4)

When Apple released the T2 security chip they also added additional options to the softwareudpate binary so it could handle BridgeOS updates. Installing a combo update on a T2 Mac is now a multi-step process. Using softareupdate step one remains unchanged, it will download the combo update from Apple which in turn stores in /Library/Updates. For step two, the Mac reaches out to Apple’s personalization service (gs.apple.com) verify the BridgeOS and combo update. When the verification is complete you will have a new folder in /Library/Updates called PersonalizedManifest.

You are automate the entire process by using sudo softwareupdate -iaR. Options -i will install the update, -a will download all updates and -R will perform an automated restart. The process works just fine if you are the logged in user. If the system needs to update the BridgeOS the Mac will shutdown and then will power back on with the T2 Chip to install the BridgeOS update. If the system does not require a BrigeOS update the system will restart to the update installer. The problem comes in if you try to automate the install from the login window using the softwareupate -R or –restart option. Softwareudpate will run run through the process listed out above only to stop at the very end and be unable to restart.

Looks great until the very end, when at the login window the system will NOT restart!

Once all your Macs are updated to 10.14.4, you can now use the -R restart for all situations. Softwareupdate can now restart the Mac if it’s at loginwindow.

3. 10.14 FV2 Authorized restarts can use the PRK (Personal Recovery Key) again.

When 10.13 arrived you could no longer perform FV2 Authenticated restarts using the PRK (Personal Recovery Key). This feature was just flat out broken. This previously worked in 10.12 Sierra and below. NOTE: You could still perform an Authorized restart with your FV2 name and password. An example of a PRK Authorized restart would be if you are a JAMF Pro customer and had a policy that installed a package but it also required a restart. You could select the option “Perform Authenticated Restart” Jamf would then send a fdesetup authrestart using the PRK. The package would install and then the system would perform an FV2 authorized reboot so the user did not have to enter in the password at the FV2 unlock screen.

10.12, 10.11 & 10.10 – Works!

sudo fdesetup authrestart = Enter a password for ‘/’, or the recovery key:

10.13 – Doesn’t work

sudo fdesetup authrestart = Enter the user name: ( hit the enter key to toggle Recovery Key Entry) = Error: Missing user name. Error: Unable to restart (error = -54).

10.14 – Works again!

sudo fdesetup authrestart = Enter the Username: (again hit the enter key to toggle Recovery Key Entry) Enter the current recovery key:

I hope that at least one of the fixes I mentioned in this article helps you. In the future I would love to see more documented Enterprise fixes listed in the combo update patch notes. Until then though, I will continue to document said fixes and let you know about them when I can.

If you have any questions or comments, please feel free to reach out!