Can't enroll devices in Profile Manager after upgrade (Server 3.2.2 -> 4.0.3)

Question

Level 1

19 points

Can't enroll devices in Profile Manager after upgrade (Server 3.2.2 -> 4.0.3)

Hi,

since an upgrade of a Profile Manager server (MOS 10.9.x + Server 3.2.2 -> MOS 10.10.2 + Server 4.0.3) we can't enroll devices. Settings profiles seems to work (not everyone is tested) and trust profile works but not enrollment profiles. I've tried both to download enrollment profiles and enroll and to enroll via My Devices web interface.

I removed some parts of IDs and domain names and replaced them with "..." in the logs below.

GUI error message

The profile “... Enrollment Profile (com.apple.ota...srv01.elits.se.bootstrap:a... ...d)” could not be installed due to an unexpected error.

<InternalError:1>

Log messages

06/02/15 14:16:17,060 syspolicyd[328]: assessment granted for EAAC_test_enrollment_post_upgrade-2.mobileconfig by _XProtect

com.apple.message.domain: com.apple.security.assessment.outcome2

com.apple.message.signature2: bundle:UNBUNDLED

com.apple.message.signature3: EAAC_test_enrollment_post_upgrade-2.mobileconfig

com.apple.message.signature5: UNKNOWN

com.apple.message.signature4: 3

com.apple.message.signature: granted:_XProtect

SenderMachUUID: A793596B-2BDE-3DD7-BC42-A32D4FEAE268

--

Feb 6 14:16:20 MacBook-Pro.local mdmclient[386]: *** ERROR *** [Agent:501] Unknown device attribute 'DeviceID' requested for Phase1 OTA authentication

--

06/02/15 14:16:47,868 com.apple.preferences.configurationprofiles.remoteservice[329]: *** ERROR *** [CPInstallerUI:501] Profile installation (EAAC test enrollment post upgrade (com.apple.ota...elits.se.bootstrap:4184d6f0-9030-0132-7925-0050569f614d)) (Status: 503 for OTA-Phase2 download from: https://...elits.se/devicemanagement/api/device/auto_join_ota_service <InternalError:1> CallStack: (

"0 mdmclient 0x000000010df8ece4 mdmclient + 31972",

"1 mdmclient 0x000000010df8ee4f mdmclient + 32335",

"2 mdmclient 0x000000010df9d5aa mdmclient + 91562",

"3 mdmclient 0x000000010df9bfad mdmclient + 85933",

"4 mdmclient 0x000000010dfaee49 mdmclient + 163401",

"5 mdmclient 0x000000010df9ea83 mdmclient + 96899",

"6 mdmclient 0x000000010dfaec5b mdmclient + 162907",

"7 mdmclient 0x000000010dfab3d9 mdmclient + 148441",

"8 libdispatch.dylib 0x00007fff8f025c13 _dispatch_client_callout + 8",

"9 libdispatch.dylib 0x00007fff8f0309a1 _dispatch_sync_f_invoke + 39",

"10 mdmclient 0x000000010dfab308 mdmclient + 148232",

"11 mdmclient 0x000000010dfab75d mdmclient + 149341",

"12 libxpc.dylib 0x00007fff861b5589 _xpc_connection_call_event_handler + 58",

"13 libxpc.dylib 0x00007fff861b404b _xpc_connection_mach_event + 1901",

"14 libdispatch.dylib 0x00007fff8f02b0f8 _dispatch_client_callout4 + 9",

"15 libdispatch.dylib 0x00007fff8f02c1a3 _dispatch_mach_msg_invoke + 445",

"16 libdispatch.dylib 0x00007fff8f029154 _dispatch_queue_drain + 571",

"17 libdispatch.dylib 0x00007fff8f02aa10 _dispatch_mach_invoke + 232",

"18 libdispatch.dylib 0x00007fff8f0286b7 _dispatch_root_queue_drain + 463",

"19 libdispatch.dylib 0x00007fff8f036fe4 _dispatch_worker_thread3 + 91",

"20 libsystem_pthread.dylib 0x00007fff8c7056cb _pthread_wqthread + 729",

"21 libsystem_pthread.dylib 0x00007fff8c7034a1 start_wqthread + 13"

))

Message was edited by: theFerret Clarifications

OS X Server, null

Posted on Feb 6, 2015 6:27 AM

Reply

Answer 1

theFerret Author

Level 1

19 points

Feb 6, 2015 6:54 AM in response to theFerret

I tried to do an enrollment by putting trust profile and enrollment profile in /var/db/ConfigurationProfiles/Setup/ (a script that removes the .profileSetupDone file and copies the profiles and then reboots the client). It didn't work either but I found this message in the client log:

06/02/15 15:42:38,764 apsd[49]: Failed to send activation record to service com.apple.ManagedClient.enroll

Reply

Answer 2

Mikep58

Level 1

10 points

Mar 11, 2015 2:57 AM in response to theFerret

Just to say that its reassuring to know I'm not the only one with this issue and I am having the exact same problem. I have escalated it as a bug report to Apple but nothing has resolved there as yet. Our version of PM was working fully after migration from 10.9.5 to OSX10.10 and Server v4 but has been broken after we did an update but i can't say which it was.

I get the device manager and log in to the PM and get Trust profiles and installation but no enrolment or install of profiles with the message:

The profile “Anyserver Enrollment Profile (com.apple.ota.xxxxxxanyserverxxxxxxxxx.bootstrap:76e3ed70-a9fe-0132-da4b-00243 6f37142)” could not be installed due to an unexpected error.

<InternalError:1>

I also get 500 Internal Server Error when trying to enrol a device also. This is really bad as a network team we are frightened of breaking a working system which seems to be so fragile. Now that WGM has officially expired in 10.10.2 we now don't have a working reliable system to manage over 1000 desktops and iPads etc. I found WGM will run if you copy it to the applications folder but it seems to produce weird behaviour and messages so its not really a fallback to Server/Profile manager not working.

I also tried to completely reset profile manager with the procedure laid out by the Apple KB but this totally broke the PM and I couldn't rebuild the Device Management and it remained disabled. I had to roll back to another previous saved version to get things partially working again. I have renewed the APNS certs as well as suggested by krypted.com but no fix there.

Hope something is sorted soon with this!

Reply

Answer 3

matti157

Level 1

9 points

Apr 18, 2016 12:15 AM in response to theFerret

I have the same problem.
how did you solve ?

My osx version is 10.11.4

Osx server app is 5.1

Reply