I recently (last night) scheduled the 10.3.2 system update to push to all devices on Friday afternoon. A few machines already had the 10.3.2 agent on them (either previously updated or having that version included in their image), however some machines simply decided to do the update early (first thing this morning), and some of those decided to wake up between 1 and 5 am this morning in order to do the update!

I've collected the zmd-message.log and the system-update logs from a few machines, and I see where the update is kicked off, but I don't know where to look to find out WHY it was kicked off so early. I'm up to over 100 machines (out of about 1300) that have completed the update, and I would estimate only 20 of those should have already had the agent on the device. So, about 80 machines and counting have mysteriously started the update days before it was scheduled; It's making me look quite silly, as I announced it wouldn't be started until Friday.

How can I track down why this is happening outside of the schedule? What logs should I be looking for, and more importantly, what messages in those logs would indicate WHY the schedule was ignored?