DEP Macs don't think they're in DEP

[AVmcclint]

We bought a batch of about 30 Macs a couple months ago and made sure they were all enrolled in DEP at the time of purchase (verified through ABM). I also verified that the PreStage Enrollment listed all the Macs we bought. I've deployed about 10 Macs from that big purchase so far and they have all enrolled and pulled down all the MDM profiles as expected... until recently. We got to a point in the stack where we're starting to see a few Macs (3 so far) that have no idea that they are supposed to be managed. We take the Macs out of the box, plug them in for power and ethernet, then we turn them on. We pick the language and country etc, tell them to use ethernet, then they completely skip over this Remote Management screen that they are supposed to see:

It goes straight into privacy and the rest of the non-DEP setup screens. I've had my techs stop the process as soon as they identify that the Remote Management screen doesn't come up. I still have a bunch more Macs that I need to setup, but so far only 3 have been identified as having this problem.

Is there anything I need to do on my end before calling Apple?

[temilit]

@mconners I have already deployed my batch of about 100 devices but I did notice now when looking they were all at delivered with OS 10.15.3, I will have a go at trying the latests patched version as i get the chance.

Thanks for the information

[swapple]

If you keep doing the ctr-opt-cmd T and getting the mbsetupuser account, then root might not be enabled.  https://derflounder.wordpress.com/2019/10/11/enabling-root-on-a-mac-which-hasnt-gone-through-macos-c...

Any more reality around stale machine with the higher fail rate?

[Scott_Conway]

We just had this start happening to our batch of Macbook M1's that were purchased in June 2021. Same scenario, the DEP enrollment has been working great. Now we have opened a few right out of the box and the devices don't know they are supposed to be managed. I know how to fix already by wiping, but the real issue is that this happens at all! It makes the process completely unreliable if we want to ship directly to users and have them self enroll.

Is there a technical reason or bug that has been identified as to why this happens? I feel like we find something new that just doesn't work correctly with Jamf on a weekly basis, which is frustrating. Or maybe this is just an Apple problem? Rolling Macs out within a large company with very high expectations has been a serious challenge as an IT admin.

[seraphina]

I haven't found a good reason why sometimes this happens, luckily if it's scoped properly in Apple School/Business manager, after going through the setup assistant you can go to terminal and just run the following command:

sudo profiles renew -type enrollment

Though this isn't ideal when it's being shipped to a user in a sealed box, but if IT touches it first, this is a good workaround to note having to wipe the device.

I also haven't found a good solution other than the above command or wiping it.

[Scott_Conway]

I want to share a new possible detail we have discovered. Our bulk purchase of M1 Macbook Pro's happened on July 21, 2021. Up until October 21, 2021 every single one we opened, the DEP enrollment worked perfectly. The last successful one was on October 20, 2021. Now each one we open, the remote management step gets skipped during the startup.

This has us very suspicious that there is some kind of "timeout" after the devices get added to DEP to the time when they make their first network connection. I find it too coincidental that exactly 3 months after we got our devices, now all of a sudden each one fails.

I'd like to know if anyone else is seeing this behavior and can pinpoint the timeline like we can.