Unable to enroll Mac Pro 4,1 into MDM in Profile Manager

Question

Level 1

4 points

Unable to enroll Mac Pro 4,1 into MDM in Profile Manager

Hi,

I've been able to enroll newer machines (Yosemite 10.10.3) from iMac 12,2 to MacPro 6,1 and MacBook Pro Retina 11,3. They all show up as managed in Profile Manager on Yosemite Server 4.1 on an iMac 4,1 but when I go through the process of enrolling an older MacPro 4,1 with clean install of Yosemite it only shows up as a New Device placeholder. Installing trust profile first then enrolling device through "MyDevice" web portal, profile installs but the machine never updates as enrolled like the other machines.

Mac Pro 4,1 specs:

- 2 x 2.26 GHz Quad-Core Intel Xeon

- 16 GB RAM

- 1 TB HDD

All machines connected through D-LInk DGS-1008A gigabit switch via an Airport Extreme (7.7.3) port. DHCP provided on OSX Server. Profile manager port opened on router.

As a side, I'm unable to delete Enrollment Profiles in Profile Manager when I do a "server error occurs" and requests to reload page but the profile is still there in the side bar. Any help is appreciated?

Thanks,

Gene

Posted on May 13, 2015 11:56 PM

Reply

Answer 1

Best reply

mscott_mdm

Level 2

459 points

May 21, 2015 10:29 AM in response to GS234

Gene,

It sounds like your MacPro isn't responding to push notifications from Profile Manager. Was the logic board ever replaced on that machine (or was it refurbished)? If the serial number is missing or more than 12 characters the machine will be unable to get the necessary push tokens from APNS and can't be used with any MDM server. Check if "About this Mac" and/or System Profiler reports an 11 or 12-character serial number. This is also a problem for virtual machines running on older versions for VMware Fusion.

Reply

Answer 2

GS234 Author

Level 1

4 points

May 28, 2015 4:11 AM in response to mscott_mdm

Thanks mscott_mdm for the reply.

My MacPro is not a refurbished unit, bought it new from Apple. The serial is listed as "Unavailable" from "About this Mac" window. In the "System Report" however is listing the Serial Number (processor tray): 13 characters, assuming it's the correct serial number.

It seems what you're suggesting is that serial numbers that are more than 12 characters are not able to receive push tokens from the MDM server? In other words incompatible? No work around?

Reply

Answer 3

May 28, 2015 8:34 AM in response to GS234

The fact that is says "unknown" is definitely suspicious. The only way to tell for sure if this is the problem is to look in /var/log/system.log for messages that look like this:

apsd[574]: Hardware SerialNumber "unknown" looks incorrect or invalid

It doesn't have to say "unknown", it can be value inside the quotes. If you see this 'Hardware SerialNumber "X" looks incorrect or invalid' message anywhere in system.log, this is definitely going to prevent the computer from enrolling in Profile Manager. (It will also prevent the machine from receiving any push notifications at all.) I do not know how to fix this problem, but I would call Apple, as this seems to be either a hardware or software issue.

(I seem mentions of programs that supposedly will set the serial number on your board, but since you seem to have one set at some level, I would be wary of messing with those.)

Good luck!

Reply

Answer 4

GS234 Author

Level 1

4 points

May 29, 2015 4:46 AM in response to mscott_mdm

You were right mscott_mdm that's what I'm getting in the system log after trying to re-enroll device:

apsd[77]: Certificate not yet generated

apsd[77]: Hardware SerialNumber "unknown" looks incorrect or invalid

Looks like it's not able to generate a certificate because it's not able to see the serial number. I'll contact Apple directly to see if I can get this resolved. I appreciate your time and help. All the best.

Reply

Answer 5

GS234 Author

Level 1

4 points

Jul 30, 2015 2:39 AM in response to GS234

Was able to take Mac Pro into authorized repair service for them to reset the hardware serial number. Motherboard was replaced a while back at Genius Bar and apparently they didn't reset the serial. Profile Manager recognizes this Mac Pro and is able to manage it fine after this fix.

Reply