Newsroom Update

Beginning in May, a special Today at Apple series titled “Made for Business” will offer small business owners and entrepreneurs free opportunities to learn how Apple products and services can support their growth and success. Learn more >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Group Profiles not applying properly after OS X 10.11

Hi all, hopefully someone can help me fix this issue we're having.

We've recently imaged a couple of iMacs using DeployStudio to the latest version of OS X (10.11), however when logging in as a user which is part of a user group, the iMacs don't seem to recognise the profile settings that should be loaded. These iMacs are connected to a domain and managed by our Mac server, they can access the domain and internet but don't seem to be able to load the profiles how they should.


We have checked the groups in the profile manager on the Mac server and the settings seem to be fine, the profiles are part of the group and they can see each other fine, the profiles deployed successfully.


Any help is appreciated. 😕

Mac mini, OS X Server

Posted on Oct 9, 2015 3:06 AM

Reply
4 replies

Oct 10, 2015 5:16 PM in response to twisted64d

Exactly how, why and when Profile Manager pushes profiles seems to be shrouded in mystery.


Try making a trivial edit to the group profile, such as adding a space to the general description, and then rebooting your re-imaged machines. Make sure the profile is 'push' not 'manual download'.


Is the profile listed in the System Preferences / Profiles panel? What happens if you login as your group-user, logout and then login again? My impression is that user profiles don't get pushed until the user logs in, which may be too late for some settings to apply to that first session.


These comments are only based on casual observations; if anybody has undertaken a more systematic investigation or has a pointer to an authoritative source I think a lot of people would be interested.


C.

Oct 12, 2015 8:49 AM in response to twisted64d

So, I've been having the same problem with 2 of my testing 10.11 clients. I think I solved it today though.


I brought up console and poked around there for a bit. I kept seeing this message

mdmclient[610]: Error: Error Domain=com.apple.accounts Code=5 "A IMAP account already exists. Only a single IMAP account is allowed to be saved."

At some point in the past, my work emails were manually added to one of my computers associated with my iCloud account. Those credentials synced through iCloud and became active when I updated to 10.11. I removed these accounts (and clicked "remove from all) and my group policies immediately started pushing.


It looks like 10.11 is a little more strict and does not handle iCloud and Profile Manager conflicts as gracefully as 10.10.


So, I don't think its group policies that actually have the problem. I just think they are what would most likely contain payloads that conflict with existing settings.


My suggestion to you would be to go through your policies and see if there are any that might conflict with existing settings elsewhere.


Hopefully this helps!

Group Profiles not applying properly after OS X 10.11

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.