Applies to: Centrify Identity Service, Mac Edition
Configuration Profiles installed on a Mac computer running OS X 10.11 after enrollment with the Centrify Identity Service may fail to be removed if the computer is un-enrolled. Failure to remove previous MDM profiles and corresponding certificate(s) may cause future enrollment attempts to fail.
An issue has been identified with computers running OS X 10.11 and has been confirmed by Apple and tracked in Apple bug #26401400. To confirm if this issue applies, the following steps can be performed to reproduce the issue:
1. Enroll the Mac and ensure the user profile containing the certificate payload is pushed to the client and installed.
2. Open the System Preferences pane and select Profiles
3. Wait 30 seconds (this will cause the mdmclient process to idle quit)
4. Open Terminal and issue the following command to verify there are no running instances of the mdmclient process:
5. Repeat until the command returns no process IDs.(This may take a minute or so if the MDM profile was just installed and the MDM server is still communicating with the client)
6. After running the command pgrep mdmclien no longer returns process IDs, issue the following command in Terminal:
7. Within 20 seconds of issuing the above command, switch back to the Profiles preference pane and manually remove the MDM enrollment profile
If the user profile is removed successfully, Apple bug #26401400 is identified as the root cause.
One option might be to set an admin preference on each client that prevents the mdmclient process from stopping when it is idle. Unfortunately, this workaround may not be applicable if a Mac client is utilizing high RAM usage as the OS may decide to stop the background process anyway.
To configure, open Terminal and issue the following command:
sudo defaults write /Library/Preferences/com.apple.mdmclient DisableIdleQuitIfHaveMDM -bool YES
Apple will look into fixing this issue in a future OS X release.