M2 MacBook Airs restarting in the middle on enrollment

[mdp]

We have a few hundred MacBook Airs that we're going to be deploy in the next couple weeks. On our test ones, during setup, after the MacBooks get all the settings, profiles, etc. from Jamf, the MacBooks restart without warning and never finish setup properly. I don't see anything that should be causing the restart, but I could be missing something obvious. 

Here's what I see in the logs Jamf-wise:

Thu Jan 26 09:55:50 MacBook Air jamf[999]: The SSL Certificate for https://xxxxxx.jamfcloud.com/ must be trusted for the jamf binary to connect to it.
Enrolling computer...
Thu Jan 26 09:55:56 MacBook Air jamf[1012]: Skipping trustJSS command...
Thu Jan 26 09:55:56 MacBook Air jamf[1012]: JMFCommons.JamfKeychain.JamfKeychainSecurityError.failedToReadJmfKeychainPassword
Thu Jan 26 09:55:56 MacBook Air jamf[1012]: JMFCommons.JamfKeychain.JamfKeychainSecurityError.failedToReadJmfKeychainPassword
Thu Jan 26 09:55:58 MacBook Air jamf[1012]: Creating user xxxxxx...
Thu Jan 26 09:56:39 MacBook Air jamf[327]: The SSL Certificate for https://xxxxxx.jamfcloud.com/ must be trusted for the jamf binary to connect to it.
Enrolling computer...
Thu Jan 26 09:56:44 MacBook Air jamf[365]: Skipping trustJSS command...
Thu Jan 26 09:56:44 MacBook Air jamf[365]: An error occurred while enrolling computer: Permission Error - The user specified does not have permission to perform the action.
Thu Jan 26 09:56:44 MacBook Air jamf[365]: Restoring JAMF.keychain since an error occurred.
Thu Jan 26 09:56:45 MacBook Air jamf[365]: Error Domain=com.jamf.jamfsecurity.error Code=-25300 "searchForItems:conversionBlock:error: : The specified item could not be found in the keychain." UserInfo={NSLocalizedDescription=searchForItems:conversionBlock:error: : The specified item could not be found in the keychain.}
Thu Jan 26 09:56:45 MacBook Air jamf[365]: Security Error - A security error has occurred.
Thu Jan 26 09:56:45 MacBook Air jamf[365]: Error Domain=com.jamf.jamfsecurity.error Code=-25300 "searchForItems:conversionBlock:error: : The specified item could not be found in the keychain." UserInfo={NSLocalizedDescription=searchForItems:conversionBlock:error: : The specified item could not be found in the keychain.}
Thu Jan 26 09:56:45 MacBook Air jamf[365]: Device Signature Error - A valid device signature is required to perform the action.
Thu Jan 26 09:56:45 MacBook Air jamf[365]: Removing existing launchd task /Library/Application Support/JAMF/tmp/com.jamfsoftware.task.policy.plist...
Thu Jan 26 09:56:45 MacBook Air jamf[365]: Enroll return code: 70
Thu Jan 26 09:56:46 MacBook Air jamf[428]: Checking for policies triggered by "enrollmentComplete"...
Thu Jan 26 09:56:47 MacBook Air jamf[428]: Error Domain=com.jamf.jamfsecurity.error Code=-25300 "searchForItems:conversionBlock:error: : The specified item could not be found in the keychain." UserInfo={NSLocalizedDescription=searchForItems:conversionBlock:error: : The specified item could not be found in the keychain.}
Thu Jan 26 09:56:48 MacBook Air jamf[428]:
There was an error.

Device Signature Error - A valid device signature is required to perform the action.

[gachowski]

So I couldn't find the thread, but with the release of M1 Big Sur, there was a bug that about 20% of my enrollments would reboot too. it ended up being creating that management account that early. I worked with Apple and Jamf on this and Apple said that it's not supported anymore and Jamf said you could add the account in a policy. I thought it might have been "fixed" but I guess not??????

[mdp]

Is it this thread I just found? Monterey: Mac Restarts after enrolment and has invalid device signature

I'd be happy to add the admin account later in a policy, but the problem is I'd like the user account to be standard rather than admin, and you can't do that in Jamf enrollment (I think) unless you also create a local admin before setup assistant.

[gachowski]

I was looking for this one... : ) I don't think the hardware matters with it only being about 20% failure it's hard to pin down....

Re: Intel MacBook Pros Not Creating New User Accou... - Jamf Nation Community - 235275

[robhealea]

I am having the same issue with M2 MacBook Airs. It's not every one, but six of the first 10 of 40 that I need to set up. I have some success when wiping the drive and trying the setup again. I've not had this issue with any other MacBooks before. It seems that if Apple didn't support this, wouldn't Jamf remove it as an option? I read through the posts on those other links. Different things for people seem to cause this.

I tried removing the three profiles I was pushing out. No change. I tried changing the Setup Assistant options. No change. 

What did work for me was to take the MacBooks off the LAN. When going through the setup process via WiFi it worked every time. Once that was done, back on the LAN to finish updating. I have no idea why that worked, or what the difference is. 

I guess add this to the list of things to try. If you are on the LAN, try WiFi. If you are on WiFi, try the LAN.