Intermittent login issues on macOS 15.1.1

[Stuart_P]

Hi,

We're starting to see a number of cases being raised internally about some of our Macs (all on macOS 15.1.1) having intermittent login issues.  Our devices are bound to AD and our users have been logging on fine for some time but now we're starting to get issues.  Sometimes the logins are fine.  Sometimes they take ~10 mins and sometimes they appear to stall completely (waited over 2.5 hours in testing) even on the same device.  The login screen appears to freeze (the time doesn't change) and you eventually get the spinning beachball.  SSH is still working and you can run a "jamf policy" successfully.  "Screen Sharing" reports that the user who has attempted to log into the device is the active user when you connect.

Can anyone share some tips as to how we would start to investigate this sort of issue let alone resolve it???

Thanks

Stuart

[Stuart_P]

This seems to be the information we're seeing in the system log...

sh-3.2# tail -F /var/log/system.log

Dec 11 16:10:37 na-622-cbca4957 loginwindow[325]: Calling completion handler for 0x600001ca5580
Dec 11 16:10:37 na-622-cbca4957 loginwindow[325]: client 0x600001ca5580: phaseName = "loginwindow Boot" is already done
Dec 11 16:10:37 na-622-cbca4957 loginwindow[325]: client 0x600001ca5580: phaseName = "loginwindow Boot", hide progress UI called
Dec 11 16:10:37 na-622-cbca4957 loginwindow[325]: ISAP: hide progress UI called
Dec 11 16:10:37 na-622-cbca4957 loginwindow[325]: client 0x600001ca5580: phaseName = "loginwindow Boot" is being released
Dec 11 16:10:37 na-622-cbca4957 loginwindow[325]: Releasing Connection
Dec 11 16:10:42 na-622-cbca4957 loginwindow[325]: The connection was interrupted, calling interruption handlers
Dec 11 16:11:08 na-622-cbca4957 loginwindow[325]: There is still an active connection
Dec 11 16:12:07 --- last message repeated 1 time ---

[Shyamsundar]

We had some network dropout issues reported on macOS 15+, it got fixed on macOS 15.2. I would sugesst upgrading to macOS 15.2 and try 

[Stuart_P]

Most of our affected devices have been updated to 15.2 and this does indeed appear to have resolved the issue.

[Stuart_P]

Sorry to come back and report that 15.2 does not appear to have fixed the issue.

[Kevm]

Hi @Stuart_P  did you ever resolve this? I have the same issue on Sonoma. A complete erase and install seems to be the only fix I have.

[Stuart_P]

Hi Kevm, we dug for hours, looking for a root cause, but we couldn't find anything.  We found it was about 15 Mac Minis across about 4 labs (probably ~100 devices) that exhibited the problem so wasn't quite as wide-spread as we initially thought.  We've now rebuilt them all as that was the only solution we found.

As above, we found this in the system log...
loginwindow[325]: The connection was interrupted, calling interruption handlers

... but we never figured out what was causing the interruption (I'm sure a better macOS admin may be able to track it down but we couldn't get anywhere and found the quickest solution was to wipe and rebuild).

[Kevm]

Thanks for the update Stuart. I have around 650 Macs but only a handful of reports. They hardly get reported so I didn't know it was happening for a while.Problem is we have so many launch agents, adobe chrome, AV, the list goes on.You dont have Netnotify or Smoothwall installed do you?. As you found it appears just the log in window process is being interrupted. I am currently compiling a list of know bad ones to re install. If I do find a magic easy fix I will report back here.

[Stuart_P]

No, we have neither of those two things.  Rebuilding the devices with 0 changes to the deployed content (although I can't talk about what might have historically been on the devices and since removed from Jamf) tells me that it was most likely to be something to do with an update to 15.x having gone slightly wrong somewhere.  The devices rebuilt to macOS 14.x and all had 15.x re-applied without issue.

[Kevm]

Yes I think almost definitely an update. Never had this issue until 14.x.