10% failure rate on DEP enrollment

[weldon]

I was at a school ipad handout event today where we saw about 10% of our iPads fail to enroll via DEP. The ipad serial numbers appear in the JSS pre-stage enrollment list. In the DEP portal, they are assigned to the server. We did use Configurator 2 beta to update them to 9.0.1 before handout (they were a mix of 8.2-8.4) but no other work on them.

Any tips on how to troubleshoot? Maybe unassign and reassign in the DEP portal?

[brad]

What was the error on the device side? Is it an authenticated enroll?

If you wipe the device and start over will it enroll?

Do you have your DEP token in another instance of your JSS?

-Brad

[weldon]

No error. It just proceeds with setup assistant without showing the screen that "the organization will configure your device" that you normally see on DEP enrollment.

I'm going to try wiping tomorrow. Some are already setup with Apple IDs (for Students) and so I likely have to force DFU without resetting passcode and appleID passwords to erase all content and settings.

Only one instance of the JSS in this case. 90% of the iPads did enroll successfully.

[brad]

This can help quite a bit:

http://lemonjar.com/iosconsole/

It lets you view the device log of the device if you plug it into your computer.

You might try adding another Prestage and move a couple of impacted devices to it and see if they enroll.

Good luck!

-Brad

[weldon]

Here is the relevant section from the log. I'm going to try and find a good device to compare logs, but I don't have one handy.

Oct 2 10:54:03 iPad IMRemoteURLConnectionAgent[184] <Warning>: WiFi is associated YES Oct 2 10:54:03 iPad mobactivationd[100] <Notice>: 0x16e1bb000 MA: create_activation_info: Type1 Message create for Setup Oct 2 10:54:04 iPad voiced[164] <Warning>: Error (hex)80000008 (int)-2147483640 at /BuildRoot/Library/Caches/com.apple.xbs/Sources/VoiceServices/VoiceServices-268/Daemon/VSSpeechServer.m:1387 (destroying TTS instance) Oct 2 10:54:04 iPad mediaserverd[25] <Notice>: '' (pid = 164) setting DiscoveryMode = DiscoveryMode_None, currentDiscoveryMode = DiscoveryMode_None Oct 2 10:54:04 iPad Setup[172] <Warning>: createActivationRequestXP: URL:(null); allHTTPHeaderFields:{ "Content-Length" = 7534; "Content-Type" = "multipart/form-data; boundary=C7BAF2E5-3C3F-4B58-AA41-82046CCE26E2"; "User-Agent" = "iOS Device Activator (MobileActivation-96 built on Aug 20 2015 at 13:20:43)"; }; HTTPBody:«--C7BAF2E5-3C3F-4B58-AA41-82046CCE26E2 Content-Disposition: form-data; name="activation-info" <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ActivationInfoComplete</key> <true/> <key>ActivationInfoXML</key> <data> DELETED </data> <key>FairPlayCertChain</key> <data> DELETED </data> <key>FairPlaySignature</key> <data> DELETED </data> </dict> </plist> --C7BAF2E5-3C3F-4B58-AA41-82046CCE26E2 Content-Disposition: form-data; name="InStoreActivation" false --C7BAF2E5-3C3F-4B58-AA41-82046CCE26E2 Content-Disposition: form-data; name="AppleSerialNumber" DMPPN1WMFK10 --C7BAF2E5-3C3F-4B58-AA41-82046CCE26E2-- »; Oct 2 10:54:04 iPad AssetCacheLocatorService[185] <Warning>: #bdb7b839 [I:AssetCacheLocatorService.queue] found caching server on 10.10.28.80:49254 Oct 2 10:54:04 iPad itunesstored[117] <Warning>: [Download]: Adding download(s): 6146594757293649616 Oct 2 10:54:04 iPad Setup[172] <Warning>: Found pod activation ticket Oct 2 10:54:04 iPad mobactivationd[100] <Notice>: 0x16e12f000 MA: handle_activate: Type1 Message handling from Setup Oct 2 10:54:04 iPad mobactivationd[100] <Error>: libMobileGestalt MGBasebandSupport.c:60: _CTServerConnectionCopyMobileEquipmentInfo: CommCenter error: 1:45 (Operation not supported) Oct 2 10:54:04 iPad mobactivationd[100] <Error>: libMobileGestalt MGBasebandSupport.c:189: No CT mobile equipment info dictionary while fetching kCTMobileEquipmentInfoIMEI Oct 2 10:54:04 iPad mobactivationd[100] <Error>: libMobileGestalt MGBasebandSupport.c:189: No CT mobile equipment info dictionary while fetching kCTMobileEquipmentInfoMEID Oct 2 10:54:04 iPad profiled[83] <Notice>: (Note ) MC: Saved activation configuration. Oct 2 10:54:05 iPad locationd[59] <Warning>: activationResult is: Activated Oct 2 10:54:05 iPad SpringBoard[53] <Warning>: lockdown says the device is: [Activated], state is 3 Oct 2 10:54:05 iPad locationd[59] <Warning>: ActivationState is activated

[cpdecker]

@weldon , I have seen this before in our environment. Sometimes when I scope a PreStage enrollment to an iPad, it doesn't "stick" for whatever reason. I go into the JSS web interface and uncheck the relevant device(s), save it, then check it again and save. That usually does the trick, although if I remember correctly I have had to do that up to two times before.

[RWitt]

We had that problem now and again and normally finish the setup assistant and then erasing all contents and setting will trigger the DEP enrollment.

Were these device out of the box or had they been used before?

[weldon]

In hindsight, it looks like one order did not register correctly even though the device serial numbers on that order showed up in the DEP portal and the pre-stage enrollment in the JSS. I unchecked the selection next to problem devices in the prestage enrollment scope, and then selected them again (actually, I clicked the shortcut to select all) and then clicked refresh.

After I did this, all worked as expected.

I did have to restore the devices to force them to activate again. The devices hold on to their activation status after you have started setup assistant. Even if you "start over" with setup assistant, it will not reach out to Apple to activate again unless you "erase all content and settings" or restore the device.

[weldon]

I also did some digging in the device logs and it looks like there is nothing in the device log that indicates if activation forces enrollment or not. Basically what happens is that you see successful activation on all devices and then later on, you see the DEP device assigned to a MDM start to download configuration profiles from the JSS. If the device is not assigned to a server, it never downloads config profiles. There is nothing in the device log to explicitly tell you that DEP says this device is assigned to a server.

It would certainly be nice to have a clear indication from the device log about DEP assignment in either condition.

[anverhousseini]

I had this issue because I skipped the "Location Services" step with the PreStage Enrollment. Since then everything works fine.

[mgdavidrocks]

This happened to our deployment too. I had 2 out of 20 iPads that will not enroll on DEP , serial numbers are on the DEP portal and assigned to the server. I had to log in to Apple School Manager- unassigned devices and assigned them back to our server, reset the iPads and then I was able to enroll via DEP.

[gsmsimon]

hi i need your help mgdavidrocks

for help i will pay $ a lot