`./scripts/status.sh` doesn't find profile

[herrernst]

./scripts/status.sh doesn't find profile. Although it is installed and working.

./scripts/status.sh                                           
macOS: 15.7.3
Profiles matching 'Software Update' deferrals:
(none found)

show -type configuration                        
user[1] attribute: name: Stay on Sequoia: Update Deferrals
user[1] attribute: configurationDescription: (null)
user[1] attribute: installationDate: 2026-01-31 12:48:35 +0000
user[1] attribute: organization: StayOnSequoia Community
user[1] attribute: profileIdentifier: org.stayonsequoia.profile
user[1] attribute: profileUUID: 7B8E6690-.........
user[1] attribute: profileType: Configuration
user[1] attribute: removalDisallowed: FALSE
user[1] attribute: version: 1
user[1] attribute: containsComputerItems: FALSE
user[1] attribute: installedByMDM: FALSE
user[1] attribute: internaldata: TRUE
user[1] payload count = 1
user[1]            payload[1] name			= Software Update Deferrals
user[1]            payload[1] description		= (null)
user[1]            payload[1] type			= com.apple.applicationaccess
user[1]            payload[1] organization		= (null)
user[1]            payload[1] identifier		= org.stayonsequoia.restrictions
user[1]            payload[1] uuid			= BF28C7DF-..............
There are 1 user configuration profiles installed for 'user'

[confluencepoint]

Fix: status.sh grep pattern doesn't match profiles show output

Problem

The current status.sh script searches for forceDelayed and enforcedSoftwareUpdate in the output of profiles show -type configuration:

/usr/bin/profiles show -type configuration 2>/dev/null | \
  grep -E "forceDelayed|enforcedSoftwareUpdate" || echo "(none found)"

This will always return "(none found)" even when the deferral profile is correctly installed.

Root Cause

profiles show -type configuration only displays metadata (name, identifier, type, UUID, etc.) — not the actual payload keys. The keys forceDelayedMajorSoftwareUpdates and enforcedSoftwareUpdateMajorOSDeferredInstallDelay exist inside the profile but are never shown in this output.

Example output with a working profile:

user[1] attribute: name: Stay on Sequoia: Update Deferrals
user[1] payload[1] name        = Software Update Deferrals
user[1] payload[1] type        = com.apple.applicationaccess

Suggested Fix

#!/usr/bin/env bash
set -euo pipefail

echo "macOS: $(sw_vers -productVersion)"
echo

echo "Installed deferral profiles:"
if /usr/bin/profiles show -type configuration 2>/dev/null | \
   grep -qiE "com\.apple\.applicationaccess|Software.?Update.?Deferral"; then
  /usr/bin/profiles show -type configuration 2>/dev/null | \
    grep -iE "name:|type:|identifier:" | head -12
  echo
  echo "✓ Deferral profile detected"
else
  echo "(none found)"
fi

Key changes:

• Match com.apple.applicationaccess (the payload type used for deferrals)
• Match profile/payload names containing "Software Update" or "Deferral"
• Case-insensitive matching (-i) for robustness

Alternative: Export and inspect XML

For verbose verification of actual payload keys:

/usr/bin/profiles show -type configuration -output stdout-xml 2>/dev/null | \
  grep -iE "forceDelayed|enforcedSoftwareUpdate|MajorOSDeferredInstallDelay"

[bikermikem]

Working for me. Thank You!

[herrernst]

Why not just check for the identifier of the installed profile?

#!/usr/bin/env bash
set -euo pipefail
echo "macOS: $(sw_vers -productVersion)"
echo "Profiles matching 'org.stayonsequoia.profile':"
/usr/bin/profiles show -type configuration 2>/dev/null | \
  grep -E "org.stayonsequoia.profile" || echo "(none found)"
echo
echo "Software Update pane (for reference only):"
defaults read /Library/Preferences/com.apple.SoftwareUpdate 2>/dev/null || true