Strange restart issue yesterday

SMR1
Contributor III

We started getting calls yesterday afternoon about Mac's that were restarting by themselves. If they had anything open, it would close the app and restart or it would just close that app and act like it was going to restart, but wouldn't. We have no policies running for updates. We did deploy Nudge a few weeks go and removed the json file that was stored on the devices, but we had a reboot today. Checked all the logs and nothing sticks out, just a lot checking for softwareupdates. Even Jamf said nothing stuck out, but provided them the sysdiagnose to check. The only thing that updated yesterday afternoon was Jamf Protect. We also noticed in the hardware and software history, that it's showing all the apps including built in apps as deleted and then added. We have a ticket open, just seeing if any of the veteran Jamf admins have seen anything like this.

SMR1_0-1683300599124.png

 

4 REPLIES 4

mikeh
Contributor II

Check the machines in question to see if they are rebooting every hour or so - using Jamf's Computer Usage record or using the last command in Terminal. If so, check the /Library/LaunchAgents directory for a com.jamfsoftware.jamf.reboot.plist (or something like that) file. If it exists, remove the file and reboot to clear the LaunchAgent from the system.

SMR1
Contributor III

They don't keep restarting, they'll just restart one time like it's an update. It only happened that day so far. I checked for the plist listed above, but didn't see one on one of the computers that restarted. On some of the systems that restarted, it shows the apps deleted like above and if you look under Inventory tab, the Applications section would say 0 apps installed. After 15-1hr, the applications would shows up, but on the system itself, it still had all the applications installed. Just chrome and edge would close.

jamf-42
Valued Contributor

do you use Title Editor? that can reboot devices if selected.. 

SMR1
Contributor III

We do have Title Editor checked. We just use to report installations of specific application, but that's checked for well over year.