Note: Devices below 14.4 should be unaffected by this change.
Impacted Machines
- (confirmed) macOS 13+, (unconfirmed macOS 12)
- Is MDM Stuck Fact is True
Potential Device Symptoms
- MDM Enrollment Profile showing expired notification, even though the Apple Push Notification (APNs) certificate is valid
- MDM Commands, like Device Lock/Device Wipe commands, do not work.
- System Updates via MDM do not kick off an update, even though one is available.
- MDM Profiles are not pushed
Problem Synopsis
Addigy Support, Product, and Engineering teams have observed a potential Apple bug where the mdmclient binary, used for communication between an MDM provider(Addigy) and the device (macOS X.X) becomes "stuck" or "hung" in it's processes. This prevents any new MDM commands from being processed on the device. We have submitted an Apple Feedback on the issue and are awaiting further details by Apple.
Current Workaround
Addigy Product and Engineering teams have released a device fact (Is MDM Client Stuck) for Admins to report on devices that are in this stuck state. We have also shared two community scripts that can help solve the problem - Kickstart Software Updates, and Restart MDMClient Service. While we do not recommend this as a long term solution, we completely understand needing an immediate workaround is needed to successfully, and securely manage devices. Here is a suggested workflow when following this workaround:
- Add the Kickstart Software Updates and Restart MDMClient Service scripts to your environment from the Addigy Community.
- Using Addigy Devices page, Look for a device that has Is MDM Stuck = True.
- Run the Restart MDMClient Service script, from the devices page.
- (Optional) If System Updates via MDM is not working as well, please run the Kickstart Software Updates script.
- (Optional) Run any MDM command. For testing purposes, we recommend running a command that will not affect end user activities. For example, Go to the Updates page in GoLive as this will kick off an MDM Command behind the scenes (AvailableOSUpdates MDM Command).
- Wait 5 minutes for the Is MDM Client Stuck fact to update itself. (Max 10 minutes just to be safe).
- Recheck the Is MDM Stuck fact on the device.
Automatic Remediation
Addigy has added the new MDM Watchdog to run on all macOS devices. The MDM Watchdog monitors the is_mdm_client_stuck and is_mdm_softwareupdated_stuck device facts. If they report the process is unresponsive, the remediation process will attempt to restart the processes.
These remediation can also be run as a one off command on devices with the command /Library/Addigy/watchdog --mdm-auto-heal.
The run events of this remediation will be recorded in /Library/Addigy/mdmclient-kickstart.txt and /Library/Addigy/softwareupdated-kickstart.txt.
If you are experiencing this behavior and need further assistance not mentioned in this article, please don't hesitate to reach out to our support team, support@addigy.com.