Posted on 04-13-2018 07:49 AM
Posted on 04-13-2018 09:19 AM
Do you have a certificate payload in the PreStage? I had to remove the built in anchor cert payload in order to get the PreStage to work.
Posted on 04-13-2018 09:26 AM
I am having the same issue, and I dont have a cert payload.
Posted on 04-13-2018 09:39 AM
I've seen this and all I needed to do to resolve it was to reformat the machine.
Posted on 04-13-2018 10:21 AM
I just finish repartitioning a Mac and I still get the same error.
Posted on 04-13-2018 01:49 PM
How about can you reach your JSS from the same network that you are trying to enroll on?
Posted on 04-13-2018 02:08 PM
I saw this for the first time today testing DEP on one machine while a different machine worked fine. Came back an hour later and the machine throwing this error went through DEP without issue..
Posted on 04-18-2018 07:12 AM
Yes, my Jamf Pro Rep had me remove the Anchor Cert payload. Also, I reinstalled the macOS on the DEP enrolled MacBook Pro two times but got the same result.
* Tried using the company public Wi-Fi, my cell phone hot spot, my Wi-Fi at home, the free public Wi-Fi in a community center; the Wi-Fi in a public library - result: the same "Unable to configure your Mac..."
Posted on 04-18-2018 07:38 AM
@SVC-SBDJamfAdmin do you have any network filtering/NAC in place? We use Forescout and for us if our key isn't there or the MAC address of my dongle isn't trusted through our DHCP filter, (or we placed on a dedicated build segment) our DEP doesn't reach both Apple and our internal
JSS JAMF Pro and the DEP fails. What I have seen is that I can usually take it to the GUI and it will DEP enroll there with a
sudo profiles renew -type enrollment
but that only applies to 10.13 machines.
Posted on 04-20-2018 11:43 AM
@easyedc Hi, We have NAC in place and we are seeing the same issue. If I do "no network" at setup assistant and try the (sudo profiles renew -type enrollment" command I get an error that a certificate chain is not configured properly.
Once I install our company cert, I can install the profile.
Do I need to upload our company cert as an anchor certificate in the DEP PreStage?
Posted on 05-10-2018 02:35 PM
Did anyone get this resolved? I've just started experiencing same problem, but it all used to work a month or two ago when I've tested last. The only change happened since was me upgrading our JSS to 10.3.1.
Posted on 05-18-2018 06:43 AM
I am also having the same issue. I have tried multiple different networks to include wired and wifi. We also have a separate external network for our department that isn't part of the regular network and that is no bueno either. I got it to work one time out of 4 machines this week by reinstalling macOS but beyond that each one I have done the same thing to it has not worked.
Posted on 05-28-2018 12:46 PM
We have also started to run into this issue frequently. During employee onboarding on the 22nd we had the issue occur across 3 separate offices at the same time. Today while doing a hardware upgrade for an employee we ran into the same issue. We initially thought it may have been network congestion during our onboarding, but today proved otherwise.
I was able to scope a prestage to my laptop and run the
sudo profiles renew -type enrollment and receive the error as well. I've reached out to jamf support, but if anyone has any interim solutions that would be awesome.
Posted on 05-29-2018 04:42 AM
Have you tried on an external network? Quite possible you need to make sure the correct ports are open. We had this previously where DEP worked in one office and didn't in another.
This is what JAMF supplied:
Be sure to allow outbound connections to Apple’s 220.127.116.11/8 block over TCP port 5223 / 443 from all client networks and on ports 2195 and 2196 from Jamf Pro servers to make sure APNs will function correctly on your network.
Posted on 05-30-2018 09:49 AM
Yup we've trie dover multiple networks, as well as connecting through a mobile hotspot. I'll pass some of those details to our networking team as well just to review the ports.
Posted on 06-05-2018 12:44 PM
Following this. Having the same issue. I've worked with JAMF CS and they are researching a solution, but nothing yet. Sorry to say it's kind of nice know that I'm not the only one.
Posted on 06-06-2018 10:56 AM
I am following because I am now seeing problems with this same thing.
Posted on 06-06-2018 12:22 PM
This is also happening to me. I just updated to 10.4.1.
Posted on 06-06-2018 01:42 PM
i saw this today for about an hour but now it's working again.
Posted on 06-21-2018 08:08 AM
Has anyone heard a solution for this yet?
Posted on 06-21-2018 12:33 PM
Something is broke at Jamf and they don't seem to be too quick to acknowledge or fix it. I'm new to Jamf so I'm wondering if this is typical? I've attempted to get two brand new MacBook Pros into DEP from work and home resulting in the same configuration error window. So far the Jamf Support people I've talked with are only offering desperate guesses. If you haven't opened a ticket yet please do so!
Posted on 07-02-2018 10:14 PM
We also saw this same problem , We tried to create new prestage enrollment, reformat device so many times, also update the DEP token problem still cannot solved. Any solution?
Posted on 07-18-2018 02:46 AM
Anyone had any luck diagnosing this yet? I'm starting to see same issue in our test lab.
Well, I say same, it's likely closely related...
sudo profiles renew -v -type enrollment gives an Error -34006. I cannot find any reference to this on the inter tubes..
Posted on 07-18-2018 03:13 AM
And in fact -34011 error too...
As you can see below, we're definitely ok out to Apple on 5223/443
dep-test-machine:~ testuser$ ~/telnet 5-courier.push.apple.com 5223 Trying 18.104.22.168... Connected to pop-namer-ne-courier.push-apple.com.akadns.net. Escape character is '^]'. ^] telnet> quit Connection closed. dep-test-machine:~ testuser$ ~/telnet 5-courier.push.apple.com 443 Trying 22.214.171.124... Connected to pop-namer-ne-courier.push-apple.com.akadns.net. Escape character is '^]'. ehlo Connection closed by foreign host. dep-test-machine:~ testuser$ sudo profiles renew -verbose -type enrollment Password: profiles: verbose mode ON profiles: returned error: 34011
Posted on 07-20-2018 09:31 AM
I am currently seeing this issue as well. We are starting to move to DEP for faculty now and not just labs. I need a solution before school starts again. Between our ordering process on campus and the DEP troubles, I am wondering if this is worth the transition. I would be interested to know the number of admins that use DEP for a majority of their devices.
Posted on 07-20-2018 09:52 AM
I am seeing this also on a batch of Macs we are trying to enroll. Was working yesterday.
Posted on 07-23-2018 10:55 AM
I am also seeing this same issue. We just made the switch to JAMF and not a promising start....
Posted on 07-23-2018 12:00 PM
This may be in relation to an open product issue with Jamf (PI-002379) which generates excess DeviceInfoAccountHash, DeviceInfoITunesActive, and ProfileList MDM commands. When these build up, MDM seems to slow down and DEP also seems affected. I would reach out to your TAM/Jamf support to see if you can confirm that you are experiencing this PI. They have a temporary fix for it until they address the issue in product.
Posted on 08-07-2018 10:38 AM
Restarting DNS services did the trick for us
Posted on 08-07-2018 01:41 PM
I do not know what is causing this but I do know how I was able to fix it for the systems experiencing it in my organization. I took their serial numbers and searched in "Devices" (where iOS devices would go) and found that they were all in there with the name: [No Name] After I deleted these entries and reinstalled a fresh copy of MacOS on each system they connected via DEP without issue.
Posted on 09-04-2018 07:42 AM
I ought to follow up on this for posterity...
Turns out that the 34011 error relates to the device being able to contact DEP servers (iprofile/albert), but not being able to reach the CRL servers (.symcb.com, .symcd.com) in order to validate that the certificate being presented to by the DEP servers has not been revoked.
Posted on 10-19-2018 04:11 PM
Anyone has a good fix for this? My instance intermittently gets bug down with this issue. I would get this issue for a few days and suddenly, it would start working again.
Posted on 10-20-2018 10:32 PM
I had the same issue on different servers:
1. Check the Jamf Pro URL in the settings
2. Check the Organization Name (don‘t use special characters like „ä“)
Posted on 10-21-2018 11:27 PM
We had exactly the same issue.
Turned out to be a policy scoped to a (static) group that did not existed anymore.
Jamf is going to fix this is in the new update.
We fixed it by re-creating the missing groups.
Posted on 01-24-2019 06:47 AM
If you still having issues, then go to the deploy wsite, download the token and upload it back to the JSS..
Posted on 02-22-2019 08:25 AM
Hi all need your help on below error while i am trying to register my iMc to DEP
We have allowed 126.96.36.199 subnet with port allow ports 80, 5223, 2195, 2196, 443
Posted on 02-22-2019 09:02 AM
We were recently having issues with apps not installing in iOS and in particular the Native apps at activation Apple has updated this document:
Our fix was to whitelist: bag.itunes.apple.com
Since we did this I am also not seeing the random messages on my prestages saying they cannot connect
Posted on 02-27-2019 11:59 AM
Posted on 09-17-2020 11:34 AM
We are still having enrollment failures. This seems to be the only source of knowledge on the matter
Posted on 12-21-2021 08:12 PM
We had the same issue and I flushed DNS cache on the client machine which fixed it.
Big sur: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder