Profile Manager Stuck on Enrolling or Pending

Question

Level 1

110 points

Profile Manager Stuck on Enrolling or Pending

Hi all,

I've got a Mac OS X Server that's running Sierra 10.12.6 with Server 5.3.1. Starting last week we've not been able to enroll new devices or push profile updates to any devices. Everything just hangs on "Pending". I've double checked the firewall (a sonic wall unit) and ports 2195, 2196, 5223, 1640, and 80/443 are all open as expected.

I've tried activating the apsd log per apple's info at https://support.apple.com/en-us/HT201063 but I'm not seeing any logs show up at /Library/Logs/apsd.log.

I did some digging through some of the other profile manager logs and found in devicemgrd.log a line stating

[545] [2017/08/28 13:43:35.309] -[DMDevicemgrd sendPendingPushNotifications]: APNS hasn't been initialized yet, unable to send push notifications

I double checked my push certificate and it was renewed in Feb, but I renewed it again today just in case.

Does anyone have any ideas?

I'm trying to avoid a full reset as I have a few hundred users and devices enrolled...

Thanks!

Mac mini, OS X Yosemite (10.10.1)

Posted on Aug 28, 2017 1:45 PM

Reply

Answer 1

Top-ranking reply

CelaK

Level 1

4 points

Oct 24, 2017 12:35 PM in response to fkick1

Hello there,

I have the same situation here.

Can you please check your "Keychain Access" for expired Apple certificates.

I have two of them :

com.apple.server.collabd - Expired 23.08.2017

com.apple.server.servermgr_xcode - Expired 23.08.2017

Reply

Answer 2

Sep 1, 2017 7:40 AM in response to fkick1

How many network connections do you have?

I had the same problem once:

2 network cards -> One with a private address to our LAN, Second with a public address reachable from the WWW...

Everything was stuck on "pending" etc

I moved the WWW-NC to the top in the network prefs (Network -> Gear-Icon -> "Set Service order..."), did a restart of the server and afterwards everything was working like before.

Hope that helps...

Reply

Answer 3

Oct 25, 2017 8:01 AM in response to fkick1

Hi!

All required FW ports are open?

https://support.apple.com/en-us/HT202487

Run that tool from your PM server and see if something comes up:

Push Diagnostics on the Mac App Store

Cheers -Peter

Reply

Answer 4

CelaK

Level 1

4 points

Sep 20, 2017 10:11 AM in response to fkick1

Since I have been running on Fusion virtualized environment, I have taken a snapshot and tried.

Removing and/or trusting expired certificates did not help solving the situation.

They were not also regenerating automatically.

Reply

Answer 5

fkick1 Author

Level 1

110 points

Sep 20, 2017 9:54 AM in response to CelaK

Hi Tearjerker,

Just one NIC, thanks.

Celak,

I did have an old expired Code Signing Cert (but not the one that was in use by profile manager), and I do have the expired com.apple.server.servermgr_xcode - Expired 27.08.2017 and com.apple.server.collabd - Expired 27.08.2017.

Should I just remove those from the keychain? Will they auto regenerate?

Thanks!
Fkick

Reply