MDM profile is getting updated but it takes long time to do it (multiple reboots)

Products

• IT Management Suite

Issue/Introduction

The customer reported that MDM (Modern Device Management) Profile is getting updated but it takes long time to do it (multiple reboots on the Mac Device).

 

The customer tried the same steps like resources membership and refresh policy in MDM server but it’s not happening immediately. 

 

Can we speed up the process to push the MDM profiles to the clients faster?

Environment

ITMS 8.6 RU2

Resolution

Main documentation on MDM can be found here:

About Modern Device Management

Setting up MDM for macOS

Answer:

Usually running schedules for membership updates, policy updates, and then updating configuration on the MDM server should be enough to receive profile policy and process it.

 

Few things to consider while troubleshooting this type of issue:

First, Is this problem is reproducible on all clients or on some single mac device? 

 

Suggestions for troubleshooting:
1) Ensure that the policy with the MDM profile is received by the MDM agent and that policy contains UDID of targeted Mac clients. This policy is located under /opt/altiris/notification/nsagent/var/policies/ on MDM Server.
2) You may need to find correct policy by searching policies' content by node MDMInstallProfilePolicy or by policy specific name. After policy is found you need to check content of <Endpoints> node - to ensure it contains UDID of affected Mac Device.(UDID of affected Mac devices can be seen on Mac device itself under About this > System Report.. > Hardware overview > UUID)

 

This is how the policy should look:

<Policy guid="{...}" name="Policytestetstest" version="...">
  <ClientPolicy agentClsid="Altiris.MDMAgent" enabled="True">
    <MDMInstallProfilePolicy>
      <Profiles>
        <Profile name="Profiletesttestest" uuid="...">...</Profile>
      </Profiles>
      <Applications/>
      <Endpoints>"4236433F-EBA9-958F-15D6-591563BAB4B8"</Endpoints>
    </MDMInstallProfilePolicy>
  </ClientPolicy>

 

In case of policy is received by the MDM server and Mac Device UDID is listed under Endpoint node, Mac device should process it.

3) Run task "Enforce policies" to force policy processing on MDM server side. Tasks may be executed from MDM Workspaces > MDM Devices > Actions menu

 

4) If it does not help, please collect and share with our Support team logs from MDM Server located under

/opt/altiris/notification/mdmagent/services/micromdm/log/

and 

/opt/altiris/notification/mdmagent/services/mdm2nse/log/

 

Make sure you are using the right Apple certificate as described under https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/it-management-suite/ITMS/Administration/About-Modern-Device-Management/Setting-up-MDM-for-macOS/mdm-macOS-APNS_certificate.html