Configuration Profile on M1 - The operation couldn’t be completed. (SPErrorDomain error 10.)

[kvnsmn]

The operation couldn’t be completed. (SPErrorDomain error 10.)

We have two Configuration Profiles for Symantec Endpoint Protection and Cisco AnyConnect client.

However, they used to work with an Intel Mac and Big Sur. We received our first M1 MacBook yesterday and it is not working.

I get the error under failed command:
The operation couldn’t be completed. (SPErrorDomain error 10.)

How exactly do I resolve this?
Our two Configuration Profiles are for the System and Kernel extensions.

Thanks!

[DBrowning]

@kvnsmn Have to remove the Kernel Ext. payload. They will not load on M1 macs.

[pmullen]

I have a CP running on 1100 M1 Macs. It is failing on one with this error. So, it isn't a flaw in the CP. What is different about this device or how it is managed. This CP is for Sophos.

[A_H]

I've had the same issue with KEXT payloads that try to load right after enrollment. If you reboot the device they should go through, and work. If you reboot before the KEXTs are scoped they will load normally.

I don't know if this is related to PI-009052, or if there's a way to get an extension attribute to help us out to keep things automated.

[Durgule]

Hey guys,
I am facing this same issue. do you have any solution ?

[kishoth_p]

@ahunter - Can you please give me some more details on KEXT payloads. I tried rebooting multiple times the issue remains same...still the config profiles fails to install

[A_H]

@Durgule I added a guaranteed reboot policy, and excluded newly set up devices from the scopes. And mostly just waiting for developers to get rid of them altogether.

@kishoth.p Google Drive File Stream, HP Printer drivers, for example. Just using the built-in Approved Kernel Extensions payload in a configuration profile.

[kishoth_p]

@ahunter - In my case I am trying to install Cisco AnyConnect KEXT which indeed fails with SP domain error. Looks like we need to have some tweaking in place for remediation

[A_H]

@kishoth.p That was also on my list but we were able to update to v4.9.04043 and now use approved System Extensions and that has worked without issue.

[kwoodard]

I am seeing this issue as well with Symantec. Is there a fix for this yet?

[BCPeteo]

Same issue here. A reboot got the cisco any connect profile down but I still get the popup. This is with v4.9.04043. The sophos one refuses to come down. Both work fine on intel

[temoteocao20]

Hi Everyone, 

I'm fresh new to jamf pro. I'm here hoping could someone help me to troubleshot this related issue I encountered in our jamf platform for this new MacBook Air M1 that I enrolled. 

Install Configuration Profile Approved Kernel - STATUS: The operation couldn't be completed. (SPEerrorDomain error 10.)

[A_H]

As far as I can tell, the best solution is for vendors to update their software to not require KEXTs.

For this bug though, it seems like a reboot of the device after setup will let them go through. I use an empty policy that enforces a reboot ASAP.

You could also temporarily exclude them from devices that have just enrolled (Smart group with Last Enrollment < 1 days ago) if they aren't time sensitive. (Or some other variable that you know won't apply until after the device has a chance to restart.)