Need help with bigsurblocker?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

236 Stars 20 Forks MIT License 18 Commits 9 Opened issues


Block Big Sur installer app from launching

Services available


Need anything else?

Contributors list

# 148,054
15 commits
# 403,818
1 commit

Big Sur Blocker

Detect when

Install macOS Big
installer application has launched, terminate the process and display an alert.


This project is heavily inspired by Erik Berglund's AppBlocker. It uses the same underlying idea of registering and listening for NSWorkspace notifications when app has started up and then checking the CFBundleIdentifier of the launched app to identify a Big Sur installer launch.


Apple wants end users to upgrade to the latest macOS as soon as it becomes available. Depending on the software and policies your organization uses, this might be unacceptable. As an administrator, you currently have some options: - Use an MDM to push a profile to delay updates for maximum of 90 days. This will however postpone all updates, not just the macOS upgrade. - If your fleet is enrolled in an MDM, you can use

softwareupdate --ignore
to hide certain updates. This will result in a highly broken user experience where the system thinks it has an update pending but it is unable to download and install it. Apple has also decided that only MDM enrolled systems can use the
flag. - If you are already using a binary authorization system such as Googles Santa, you should use it but deploying a system like Santa only for blocking Big Sur might be unfeasible.



binary is installed in
and is launched for each user through a launch agent. This means that the binary is running in the user session and therefore has the privileges of the current user. It runs silently in the background and listens for app launch notifications. As soon as the user launches the macOS installer application, the binary (forcefully) terminates it and displays a warning message.

By design, it will not block the

command line tool.


The binary requires at least macOS 10.9, however it has been tested only on macOS 10.10, 10.11, 10.12, 10.13, 10.14 and 10.15.

Note. It seems that macOS 10.10 and 10.11 have trouble installing a signed and notarized package. Use the unsigned package available from the releases page if deploying on those. The signed and notarized package can be used on macOS 10.12 and later.


All configuration is optional. If needed, the alert title and text can be set through a configuration profile. Use

as the domain and
as the keys.


On macOS 10.12 and later, download a prebuilt package from the Releases page and deploy with your favorite method. The package is signed and notarized.

On OS X 10.11 and earlier, download and deploy an unsigned package from the Releases page and deploy with your favorite method


To fully uninstall

, run the following (as root or with sudo):
current_user_uid=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/UID :/ && ! /loginwindow/ { print $3 }' )

launchd_item_path="/Library/LaunchAgents/com.hjuutilainen.bigsurblocker.plist" launchctl bootout gui/${current_user_uid} "${launchd_item_path}"

rm -f /Library/LaunchAgents/com.hjuutilainen.bigsurblocker.plist rm -f /usr/local/bin/bigsurblocker

pkgutil --forget com.hjuutilainen.bigsurblocker


Big Sur Blocker is licensed under the MIT License.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.