JSS Lock Computer

Similar thread here: https://jamfnation.jamfsoftware.com/discussion.html?id=18887
Seems there may be some type of issue with this MDM command that can cause it to get stuck. Apple probably should address this, but they likely won't bother.

@mm2270 I found that post when I first started looking for a fix. All the Apple tech told me when I took it to the store was that he does not recognize the lock screen and that I needed to talk to JAMF.

What happens if you hold down Cmd, Alt, Ctrl, Shift + S on startup?

I was under the impression that Apple could unlock it. It might wipe the device in the process, but at least the computer will be usable again. Are you saying they aren't able to do even that because that's strange?

@davidacland Tried holding down those keys and it just booted to the same lock screen.

@bpavlov Yes, the Apple genius at the store said the lock screen was not an Apple lock and did not know what to do with it. The AppleCare rep did not know what to do with the screen either. See attached for the screenshot of the lock screen after the timer runs out.

Have you tried pressing the Option key at startup?, I had the same issue and after manually selecting the partition. I was able to enter the unlock pin.

When I boot holding down the option key, I get the prompt for the firmware password, I enter that. The only drive that pops up is Macintosh HD. I selected the drive and hit enter. It then booted back to the same lock screen.

Also wiping this machine and starting from zero is something I am willing to do to solve this.

If it gets that far holding down the alt key you will hopefully be able to boot to netboot or an external drive with OS X installed and wipe the internal Macintosh HD.

@davidacland I have tried booting to flash drive that is configured to install 10.11. When I try to boot to that drive it allows me to select it, but it never starts the install process. It just boots to the lock screen. I have also tried booting the machine in target disk mode, which does not work either.

Are you launching disk utility first and wiping the drive?

@davidacland It does not give me the option to open disk utility. I see language preferences appear in the top left corner for half a second and then it pops back to the lock screen.

Is the Mac connected to a network when you're booting into your flash drive? I believe the lock screen is coming from MDM, despite what Apple seems to think, though I'm really not certain on that. Have you tried booting it up off that flash drive completely disconnected from any network connection to see what happens?

@mm2270 The mac is not connected to the network via an ethernet cable, it could be connected via wi/fi though. Not sure if there is a point during boot up that a Mac will turn on wi/fi and connect. I could try going off campus and doing a reboot.

just curious, are you able to target disk mode into it? not sure how much that will help but this is all very interesting behavior. haven't seen it before.

@bpavlov I am not able to boot into target disk mode.

Hmm, well, you could try that I guess. I'm not sure what happens exactly when a Mac receives that lock command. I'm actually thinking now that it sets a state in the firmware that the Mac is forced to boot into a lock mode, so even if it can't connect to a network it will likely still boot into that screen. It wouldn't be the most secure if one could bypass it simply by making sure it wasn't connected to the internet.

I'm really surprised Apple is saying they can't help here. I believe MDM lock commands, among other things are coming from Apple's APNs and not really from Casper. The Casper Suite simply sends APNs a command to go out and lock the Mac in question and APNs does the rest. IOW, I think once the command is handed over to Apple's servers, the JSS has nothing to do with it from there. But I may be wrong, since its been awhile now since I closely examined all this. And what is JAMF saying about this situation?

@mm2270 You are probably right that going offline will not help since that would be a security flaw. But I am willing to try anything at this point.

I am also surprised that both Apple and JAMF do not know where to go from here. JAMF has basically said that there is nothing more they can do and handed the issue off to Apple to fix.

I'm going to side with JAMF here, because as I said, unless I'm way off, all the JSS is doing is sending a request to Apple's APNs to send a lock command down to the MDM managed device. I don't see how this is JAMF's issue to solve. The way its actually supposed to work is if the passcode is entered incorrect a couple of times, it increments a time to wait value, and gets increasingly larger with each incorrect attempt, so it should be indicating that you can't try another passcode for x more minutes or something, not just a "wrong password" screen. It looks almost like a bug in the way the firmware is handling the lock issue to me, which is not very comforting if that's the case. Talk about bricking Macs. For an environment that needs to rely heavily on the MDM commands feature, this could be a potential nightmare.
If I can think of anything else to try I'll post back, but honestly, I'm running out of ideas myself. Hopefully someone else has some good suggestions for you.

i haven't come across this in macs yet, but have in ios. according to apple this in "expected behavior"... in ios anyway. when you set the pass code you have to option to automatically wipe the device if the wrong code is entered 10 times. if you choose not to auto erase the device it just gets bricked after 10 incorrect passcode attempts. at that point your only option is a DFU wipe and restore.... apple calls this a "security feature"

i call it a pain in the ass.

it wouldn't surprise me at all to see the same behavior in mac os too.

is it accessible over the network? can you ssh into it? or maybe can the JSS issue a wipe command?

@lpadmin try booting the machine from a recovery partition on an external disk. I've seen this happen when a computer has a bad recovery partition, and essentially the lock procedure never successfully completes. Once it boots to the external recovery volume, you should be able to unlock on the next boot.

@jchurch I tried to send the wipe command from JSS and it just sits at pending after restarting the computer 5 times while wired with an ethernet cable.

@luisgiraldo I tried finding how to create a recovery disk on a flash drive for 10.11. It appears that Mac stopped using them after Mountain Lion. Newer macs replaced it with internet recovery, which I have tried and does not work. Do you know how to create one for 10.11?

if you take another working 10.11 laptop and put it in target disk mode your bricked laptop should see both the OS and Recovery partitions.

UPDATE

I was able to get the computer to boot into target disk mode. From there I plugged it into my computer and after 5 attempts Disk Utility was able to wipe the computer. Now when I boot it, I get the folder with ? flashing on the screen. I then tried using my OS X install flash drive and after selecting the drive it still goes to the lock screen. I then tried internet recovery and @jchurch suggestion and still getting the lock screen.

@lpadmin is there a record for the computer in Casper still? I'm wondering what would happen if you deleted the computer record from Casper, wiped the drive completely, put on a fresh OS, then boot the computer up does it still go to the lock screen? If it does, then the lock screen likely isn't being caused by Casper. Then you may need to get Apple involved to determine what is still causing the lock screen.