Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-6963: Mac re-enrollment fails because certificate-based profiles from the previous enrollment fail to remove

17 June,16 at 11:20 PM

Applies to: Centrify Identity Service, Mac Edition
 
 
 
Problem:
 
Configuration Profiles installed on a Mac computer running OS X 10.11 after enrollment with the Centrify Identity Service may fail to be removed if the computer is un-enrolled. Failure to remove previous MDM profiles and corresponding certificate(s) may cause future enrollment attempts to fail.
 
 
Cause:
 
An issue has been identified with computers running OS X 10.11 and has been confirmed by Apple and tracked in Apple bug #26401400. To confirm if this issue applies, the following steps can be performed to reproduce the issue:

1. Enroll the Mac and ensure the user profile containing the certificate payload is pushed to the client and installed.
2. Open the System Preferences pane and select Profiles
3. Wait 30 seconds (this will cause the mdmclient process to idle quit)
4. Open Terminal and issue the following command to verify there are no running instances of the mdmclient process:
 
       pgrep mdmclient

5. Repeat until the command returns no process IDs.(This may take a minute or so if the MDM profile was just installed and the MDM server is still communicating with the client)

6. After running the command pgrep mdmclien no longer returns process IDs, issue the following command in Terminal:
 
       /usr/libexec/mdmclient nop

7. Within 20 seconds of issuing the above command, switch back to the Profiles preference pane and manually remove the MDM enrollment profile
 
 
If the user profile is removed successfully, Apple bug #26401400 is identified as the root cause.
 
 
Workaround:

 
One option might be to set an admin preference on each client that prevents the mdmclient process from stopping when it is idle.  Unfortunately, this workaround may not be applicable if a Mac client is utilizing high RAM usage as the OS may decide to stop the background process anyway.  
 
To configure, open Terminal and issue the following command:
 
sudo defaults write /Library/Preferences/com.apple.mdmclient DisableIdleQuitIfHaveMDM -bool YES
 
 
Solution:
 
Apple will look into fixing this issue in a future OS X release.  

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.