Intel and M1 Macs restart/shutdown hanging

[Redshirt26]

Hey everyone,

We currently have an issue with a number of our intel and M1 Macs where we click the restart or shutdown option and the Mac just hangs on the wallpaper. If they do eventually shutdown or restart the Mac then gets stuck on the apple loading bar. The only thing that works is a Forced shutdown. Login and logoff aren't effected either.

At first we thought it could be software not closing properly (we blamed Epic at first) but we have stopped this and others from launching but the issue still persists, I have gone through both launch folders in Library but none of those seems to be causing the issue.

We then thought it might be stuck installing updates as we recently updated the Macs to 11.6, but that doesn't seem to be the cause, I have checked the updates cache folder and manually checked for updates just incase it had failed the first time.

I have gone through the logs but nothing is standing out that I can see. I have tried a PRAM reset on one of the Macs but that doesn't fix the issues.

This has all recently just started to happen too, and the only big difference that we have made recently is pushing out the most recent OSX update (11.5.2 - 11.6)

Just wondering if anyone else has had a similar issue in the past?

Cheers

[andrew_nicholas]

I know there is an issue like this with the latest Microsoft Defender and the most recent Catalina security update. I don't believe it affects BigSur devices but it might be worthwhile to begin a piecemeal uninstall of any recently update management tools like AV/EDR and see if the issue persists.

[Redshirt26]

Thanks @andrew_nicholas we use JAMF protect, so I uninstalled it from one of the problematic Macs but that didn't fix the issue. I also removeframwork'd the Mac from JAMF but that still didn't help.

We will rebuild a couple of them to see how that goes, but it would be good if we can avoid rebuilding all our rooms 🙂

[danny_gutman]

Following this because I too have experienced it, on my own machine enrolled into JSS, on Big Sur. 

[Redshirt26]

Hi All, 

So a little bit of an update, unfortunately, we are still yet to find a fix for the issue. At the moment I have noticed that the issue seems to be with the shutdown and restart options from the menu bar (Shutdown hangs, restart hangs then reboots after a while but then gets stuck at the apple logo screen) and also at the login screen (neither the shutdown nor restart option works, the screen goes black but then you shake the mouse and you are back at the login screen)

Interestingly though the sudo shutdown and restart commands via terminal work without any issues. 

I did some log digging and found the following failed processes happening when I clicked restart and also at bootup:

Clicked restart button
Nov 4 11:54:19 PKTC103B-025 systemstats[105]: assertion failed: 20G95: systemstats + 413748 [F3867909-0B62-389F-8F1D-33E6671E7A01]: 0x0
Nov 4 11:54:19 PKTC103B-025 systemstats[105]: assertion failed: 20G95: systemstats + 615252 [F3867909-0B62-389F-8F1D-33E6671E7A01]: 0x2
Nov 4 11:54:33 PKTC103B-025 com.apple.xpc.launchd[1] (com.apple.coreservices.UASharedPasteboardProgressUI): Unknown key for Boolean: DrainMessagesAfterFailedInit
Nov 4 11:54:33 PKTC103B-025 com.apple.xpc.launchd[1] (com.apple.coreservices.useractivityd): Unknown key for Boolean: DrainMessagesAfterFailedInit

Start up hanging at apple icon
Nov 4 11:57:04 localhost systemstats[105]: assertion failed: 20G95: systemstats + 186096 [F3867909-0B62-389F-8F1D-33E6671E7A01]: 0x0
Nov 4 11:57:09 localhost com.apple.xpc.launchd[1] (com.apple.coreservices.UASharedPasteboardProgressUI): Unknown key for Boolean: DrainMessagesAfterFailedInit
Nov 4 11:57:09 localhost com.apple.xpc.launchd[1] (com.apple.coreservices.useractivityd): Unknown key for Boolean: DrainMessagesAfterFailedInit
Nov 4 11:57:10 PKTC103B-025 bootinstalld[338]: getattrlist failed for /System/Volumes/Data/.com.apple.templatemigration.boot-install.plist: #2: No such file or directory
Nov 4 11:57:11 PKTC103B-025 systemstats[105]: assertion failed: 20G95: systemstats + 615252 [F3867909-0B62-389F-8F1D-33E6671E7A01]: 0x2
Nov 4 11:57:11 PKTC103B-025 systemstats[105]: assertion failed: 20G95: libsystemstats.dylib + 46232 [7D6A1CA2-2992-3921-9C06-2CFD0939B592]: 0x2d
Nov 4 11:57:11 PKTC103B-025 systemstats[105]: assertion failed: 20G95: systemstats + 413748 [F3867909-0B62-389F-8F1D-33E6671E7A01]: 0x0
Nov 4 11:57:11 PKTC103B-025 systemstats[105]: assertion failed: 20G95: systemstats + 615252 [F3867909-0B62-389F-8F1D-33E6671E7A01]: 0x2
Nov 4 11:57:12 PKTC103B-025 PerfPowerServices[154]: assertion failed: 20G95: PowerlogCore + 771968 [52DDAFF2-1AE9-3924-A6CE-D8AA7FA8D372]: 0x3
Nov 4 11:57:12 PKTC103B-025 MRT[104]: getattrlist failed for : #2: No such file or directory
Nov 4 11:57:12 PKTC103B-025 MRT[104]: getattrlist failed for : #2: No such file or directory
Nov 4 11:57:35 PKTC103B-025 com.apple.xpc.launchd[1] (com.apple.coreservices.UASharedPasteboardProgressUI): Unknown key for Boolean: DrainMessagesAfterFailedInit
Nov 4 11:57:35 PKTC103B-025 com.apple.xpc.launchd[1] (com.apple.coreservices.useractivityd): Unknown key for Boolean: DrainMessagesAfterFailedInit
Nov 4 11:57:35 PKTC103B-025 com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.501.100005.Aqua): Failed to bootstrap path: path = /System/Library/LaunchAgents/com.apple.SafeEjectGPUAgent.plist, error = 138: Service cannot be loaded on this hardware
Nov 4 11:57:35 PKTC103B-025 com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.501.100005.Aqua): Failed to bootstrap path: path = /System/Library/LaunchAgents/com.apple.CoreAuthentication.agent.plist, error = 17: File exists
Nov 4 11:57:35 PKTC103B-025 com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.501.100005.Aqua): Failed to bootstrap path: path = /System/Library/LaunchAgents/com.apple.MemorySlotNotification.plist, error = 138: Service cannot be loaded on this hardware
Nov 4 11:57:35 PKTC103B-025 com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.501.100005.Aqua): Failed to bootstrap path: path = /System/Library/LaunchAgents/com.apple.trustd.agent.plist, error = 17: File exists
Nov 4 11:57:35 PKTC103B-025 com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.501.100005.Aqua): Failed to bootstrap path: path = /System/Library/LaunchAgents/com.apple.eospreflightagent.plist, error = 138: Service cannot be loaded on this hardware
Nov 4 11:57:35 PKTC103B-025 com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.501.100005.Aqua): Failed to bootstrap path: path = /System/Library/LaunchAgents/com.apple.ExpansionSlotNotification.plist, error = 138: Service cannot be loaded on this hardware
Nov 4 11:57:35 PKTC103B-025 com.apple.xpc.launchd[1] (com.apple.xpc.launchd.user.domain.501.100005.Aqua): Failed to bootstrap path: path = /System/Library/LaunchAgents/com.apple.ctkd.plist, error = 17: File exists
Nov 4 11:57:36 PKTC103B-025 Finder[830]: assertion failed: 20G95: libxpc.dylib + 97932 [33FB2ED1-AB10-3900-BA93-5767A5086AD7]: 0x89
Nov 4 11:57:41 PKTC103B-025 MRT[943]: getattrlist failed for : #2: No such file or directory
Nov 4 11:57:43 PKTC103B-025 EpicGamesLauncher-Mac-Shipping[971]: getattrlist failed for /System/Library/Frameworks/OpenGL.framework/Resources//GLRendererFloat.bundle/GLRendererFloat: #2: No such file or directory
Nov 4 11:57:43 PKTC103B-025 EpicWebHelper[1118]: getattrlist failed for /System/Library/Frameworks/OpenGL.framework/Resources//GLRendererFloat.bundle/GLRendererFloat: #2: No such file or directory

This is where I hope someone can swoop in and help me figure out what is happening with these failed processes as understanding them fully is not one of my experienced skills and google is not being very helpful. I'm hoping one of these is what is causing the issue..... fingers crossed 🙂

[Redshirt26]

Hi to anyone that comes across this post.

Just an update, we have figured out what is causing the issue. The culprit seems to be the macOS security updates, so with us, it's 11.6.1 and/or 11.6.2.

The issue seems to happen when we install the update using the installer over our existing Big Sur image, so if we go from 11.6 - 11.6.1 or 11.6.1 - 11.6.2. If we wipe a mac that used to have 11.6 but install a fresh copy of 11.6.1 then go through our prestage enrollment then everything is fine. as soon as we update to 11.6.2 the shutdown issues reappear. 

We have a ticket open with JAMF to see if they know why this would be happening. It might just be a Big Sur issue (fingers crossed), but we haven't fully tested the same process with Monterey.

[Redshirt26]

Update Update: turns out it's not the apple installer but its actually the jamf software update payload set in a policy that causes the issue.

[glpi-ios]

Hi @Redshirt26 
We don't use the jamf software update payload but we also have this issue when updating to Big Sur, whether through the Apple installer or through the system preferences.

[Redshirt26]

So I'm just posting back on here as we have finally figured out why this is happening to our Macs. It seems to be our Jamf protect instance that is causing our Macs to behave this way. If one of our Macs has our default JAMF protect policy installed on them, if I send our update commands via remote command, superman, or via a policy it will download and begin the install but then hang when it restarts. 

If I exclude a Mac from our JAMF protect instance then it installs the update without any issues.

I have opened a case with JAMF, but just thought I'd add this if anyone else comes across this post with the same issue.

[jamesdurler]

We are currently experiencing a similar issue on random macOS ventura devices. We are not using JAMF protect and I'm not having much luck with apple logs and/or apple support. Anyone else still got this issue?

[Redshirt26]

Hi @jamesdurler 

For me after months of testing I figured out it was a legacy xcode policy that had been created by my predecessor that used a script to edit a bunch of user groups/preferences. This was messing with the apple security updates during the install. 

When the Macs were updating and got to the restart part it was looking at the users and for whatever reason this xcode policy was messing things up. 

I stopped the policy, but the affected Macs needed to be rebuilt. Once they were I was able to update them without issue.

I hope this is a similar issue to what you are experiencing and if so I hope this helps with the fix. 

[jamesdurler]

Hi @Redshirt26 ,

Thank you so much. This is definitely the problem in our environment. There is an old finalise Xcode script which runs for anyone with Xcode installed.

I wanted to see if I could fix machines which were broken by reversing the settings in the finalise Xcode script and I've narrowed it down to this as the cause of the problem:

# alter authorisation database to allow installation of apple components without admin rights
security authorizationdb read system.install.apple-software > /tmp/xcode.plist
defaults write /tmp/xcode.plist rule -array authenticate-session-owner-or-admin
security authorizationdb write system.install.apple-software < /tmp/xcode.plist

I found that if you reset this back to default it then magically starts rebooting

security authorizationdb read system.install.apple-software > /tmp/xcode.plist
defaults write /tmp/xcode.plist rule -array root-or-entitled-admin-or-authenticate-admin
security authorizationdb write system.install.apple-software < /tmp/xcode.plist

Thank you so much for pointing this out, this has been driving me crazy for quite a while now!

[Redshirt26]

That's great, I'm glad it was the same issue so that you could apply the fix.

Also great that your were able to find a better way to fix the issue other than rebuilding the device. Will be super helpful, so thank you for this.