Unable to Connect to the MDM Server for your Organization

SVC-SBDJamfAdmi
New Contributor II
  • Attempting to initiate Zero Touch Deployment with DEP enrolled MacBook Pro.
  • After entering login info at the "Select Your Wi-Fi" prompt, the Remote Management screen appears.
  • Click the Continue button and a "Unable to Connect to the MDM Server for your Organization" appears.
  • Attempted the same process on both a public Wi-Fi network and on the company Wi-Fi network. Got the same result.
  • Does a port need to be opened or some other configuration need to the modified?d5bb3678940445f383e1749292cc59de
39 REPLIES 39

m_donovan
Contributor III

Do you have a certificate payload in the PreStage? I had to remove the built in anchor cert payload in order to get the PreStage to work.

isradame
Contributor

I am having the same issue, and I dont have a cert payload.

dgreening
Valued Contributor II

I've seen this and all I needed to do to resolve it was to reformat the machine.

isradame
Contributor

I just finish repartitioning a Mac and I still get the same error.

gachowski
Valued Contributor II

How about can you reach your JSS from the same network that you are trying to enroll on?

C

mapurcel
Contributor II

I saw this for the first time today testing DEP on one machine while a different machine worked fine. Came back an hour later and the machine throwing this error went through DEP without issue..

SVC-SBDJamfAdmi
New Contributor II

Yes, my Jamf Pro Rep had me remove the Anchor Cert payload. Also, I reinstalled the macOS on the DEP enrolled MacBook Pro two times but got the same result.
* Tried using the company public Wi-Fi, my cell phone hot spot, my Wi-Fi at home, the free public Wi-Fi in a community center; the Wi-Fi in a public library - result: the same "Unable to configure your Mac..."

easyedc
Valued Contributor II

@SVC-SBDJamfAdmin do you have any network filtering/NAC in place? We use Forescout and for us if our key isn't there or the MAC address of my dongle isn't trusted through our DHCP filter, (or we placed on a dedicated build segment) our DEP doesn't reach both Apple and our internal JSS JAMF Pro and the DEP fails. What I have seen is that I can usually take it to the GUI and it will DEP enroll there with a

sudo profiles renew -type enrollment

but that only applies to 10.13 machines.

isradame
Contributor

@easyedc Hi, We have NAC in place and we are seeing the same issue. If I do "no network" at setup assistant and try the (sudo profiles renew -type enrollment" command I get an error that a certificate chain is not configured properly.
Once I install our company cert, I can install the profile.
Do I need to upload our company cert as an anchor certificate in the DEP PreStage?

Alex33
New Contributor

Did anyone get this resolved? I've just started experiencing same problem, but it all used to work a month or two ago when I've tested last. The only change happened since was me upgrading our JSS to 10.3.1.

cssd11macadmin
New Contributor

I am also having the same issue. I have tried multiple different networks to include wired and wifi. We also have a separate external network for our department that isn't part of the regular network and that is no bueno either. I got it to work one time out of 4 machines this week by reinstalling macOS but beyond that each one I have done the same thing to it has not worked.

ronnie_leblanc
New Contributor

We have also started to run into this issue frequently. During employee onboarding on the 22nd we had the issue occur across 3 separate offices at the same time. Today while doing a hardware upgrade for an employee we ran into the same issue. We initially thought it may have been network congestion during our onboarding, but today proved otherwise.

I was able to scope a prestage to my laptop and run the sudo profiles renew -type enrollment and receive the error as well. I've reached out to jamf support, but if anyone has any interim solutions that would be awesome.

kowsar_ahmed
Contributor

Have you tried on an external network? Quite possible you need to make sure the correct ports are open. We had this previously where DEP worked in one office and didn't in another.

This is what JAMF supplied:

https://www.jamf.com/jamf-nation/articles/34/network-ports-used-by-jamf-pro

Be sure to allow outbound connections to Apple’s 17.0.0.0/8 block over TCP port 5223 / 443 from all client networks and on ports 2195 and 2196 from Jamf Pro servers to make sure APNs will function correctly on your network.

ronnie_leblanc
New Contributor

Yup we've trie dover multiple networks, as well as connecting through a mobile hotspot. I'll pass some of those details to our networking team as well just to review the ports.

lamaral
New Contributor II

Following this. Having the same issue. I've worked with JAMF CS and they are researching a solution, but nothing yet. Sorry to say it's kind of nice know that I'm not the only one.

ethomas74
New Contributor II

I am following because I am now seeing problems with this same thing.

deleonf
New Contributor

This is also happening to me. I just updated to 10.4.1.

lpmiller
New Contributor

i saw this today for about an hour but now it's working again.

adamlalicker
New Contributor III

Has anyone heard a solution for this yet?

MacGeek
New Contributor III

Something is broke at Jamf and they don't seem to be too quick to acknowledge or fix it. I'm new to Jamf so I'm wondering if this is typical? I've attempted to get two brand new MacBook Pros into DEP from work and home resulting in the same configuration error window. So far the Jamf Support people I've talked with are only offering desperate guesses. If you haven't opened a ticket yet please do so!

saishk
New Contributor

We also saw this same problem , We tried to create new prestage enrollment, reformat device so many times, also update the DEP token problem still cannot solved. Any solution?

dfarnworth_barc
New Contributor III

Anyone had any luck diagnosing this yet? I'm starting to see same issue in our test lab.

Well, I say same, it's likely closely related...

Running sudo profiles renew -v -type enrollment gives an Error -34006. I cannot find any reference to this on the inter tubes..

dfarnworth_barc
New Contributor III

And in fact -34011 error too...

As you can see below, we're definitely ok out to Apple on 5223/443

dep-test-machine:~ testuser$ ~/telnet 5-courier.push.apple.com 5223
Trying 17.249.108.77...
Connected to pop-namer-ne-courier.push-apple.com.akadns.net.
Escape character is '^]'.
^]
telnet> quit
Connection closed.
dep-test-machine:~ testuser$ ~/telnet 5-courier.push.apple.com 443
Trying 17.249.108.90...
Connected to pop-namer-ne-courier.push-apple.com.akadns.net.
Escape character is '^]'.
ehlo
Connection closed by foreign host.
dep-test-machine:~ testuser$ sudo profiles renew -verbose -type enrollment
Password:
profiles: verbose mode ON
profiles: returned error: 34011

Jmw0039
New Contributor III

I am currently seeing this issue as well. We are starting to move to DEP for faculty now and not just labs. I need a solution before school starts again. Between our ordering process on campus and the DEP troubles, I am wondering if this is worth the transition. I would be interested to know the number of admins that use DEP for a majority of their devices.

--
Matthew Warren
College of Liberal Arts
Auburn University


pmartin
New Contributor II

I am seeing this also on a batch of Macs we are trying to enroll. Was working yesterday.

siepmannm
New Contributor

I am also seeing this same issue. We just made the switch to JAMF and not a promising start....

dgreening
Valued Contributor II

This may be in relation to an open product issue with Jamf (PI-002379) which generates excess DeviceInfoAccountHash, DeviceInfoITunesActive, and ProfileList MDM commands. When these build up, MDM seems to slow down and DEP also seems affected. I would reach out to your TAM/Jamf support to see if you can confirm that you are experiencing this PI. They have a temporary fix for it until they address the issue in product.

harmonix
New Contributor

Restarting DNS services did the trick for us

ABigRock
New Contributor III

I do not know what is causing this but I do know how I was able to fix it for the systems experiencing it in my organization. I took their serial numbers and searched in "Devices" (where iOS devices would go) and found that they were all in there with the name: [No Name] After I deleted these entries and reinstalled a fresh copy of MacOS on each system they connected via DEP without issue.

dfarnworth_barc
New Contributor III

I ought to follow up on this for posterity...

Turns out that the 34011 error relates to the device being able to contact DEP servers (iprofile/albert), but not being able to reach the CRL servers (.symcb.com, .symcd.com) in order to validate that the certificate being presented to by the DEP servers has not been revoked.

rhovicoana
New Contributor

Anyone has a good fix for this? My instance intermittently gets bug down with this issue. I would get this issue for a few days and suddenly, it would start working again.

anverhousseini
Contributor II
Contributor II

I had the same issue on different servers:
1. Check the Jamf Pro URL in the settings
2. Check the Organization Name (don‘t use special characters like „ä“)

j_stroomberg
New Contributor

We had exactly the same issue.
Turned out to be a policy scoped to a (static) group that did not existed anymore.
Jamf is going to fix this is in the new update.

We fixed it by re-creating the missing groups.

kerouak
Valued Contributor

If you still having issues, then go to the deploy wsite, download the token and upload it back to the JSS..

done!

sanjeev
New Contributor

Hi all need your help on below error while i am trying to register my iMc to DEP

We have allowed 17.0.0.0 subnet with port allow ports 80, 5223, 2195, 2196, 443

e89c27a3a36e4cdcadd50954e5f12d6a

Sandy
Valued Contributor II

We were recently having issues with apps not installing in iOS and in particular the Native apps at activation Apple has updated this document:

https://support.apple.com/en-us/HT201999

Our fix was to whitelist: bag.itunes.apple.com

Since we did this I am also not seeing the random messages on my prestages saying they cannot connect

melihsancar
New Contributor

We have the exact problem at the moment. svc-sbdjamfadmin Did you find any proper solution?

kevin_v
Contributor

We are still having enrollment failures. This seems to be the only source of knowledge on the matter
https://nstrauss.github.io/mitigating-mac-enrollment-failures/

Ying
New Contributor

We had the same issue and I flushed DNS cache on the client machine which fixed it.

Big sur:  sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder