Shared iPad - iPadOS 17 issues

[SimonGGS]

Hello everyone,

yesterday, I pushed out the update to our 150 Shared iPads and today I saw, that they all lost their wallpaper, WiFi as well as the complete connection to our MDM. A connection with Apple Configurator 2 was not possible, too. The devices did not check in anymore and our team had to reset all of them via Recovery Mode.

We are using Jamf School.

Anyone having a solution for this?

Thanks!

[DHSchool]

Hi Simon,

Exactly the same issue here - we have 200 iPads on-site, all deployed as 'Shared iPads', and they have all lost their Wi-Fi and wallpaper profiles, plus are not checking in to Jamf School.

Have you received any updates?

Thanks!

Billy

[SimonGGS]

Hi Billy,

currently I have not received any updates, yet. We are trying to upgrade an iPad from iPadOS 16.6.1 to the yesterday released iPadOS 17.0.2 and want to test if the issue still exists. I will post an update as soon as we are finished with the test.

Unfortunately, Apple did not call me back on my support ticket, so I did not get any updates from them, too. 

I will not limit the issue to the loss of the WiFi and Wallpaper Profile. I think all other settings are also lossed but because we cannot login anymore, we cannot check this.

Our current solution is to manually boot all devices into Recovery Mode and use the Recovery Options on the Mac to reinstall iPadOS 17. After setup, the iPad checks in again and everything works fine again. And as your and our iPads lost the WiFi connection, I would say that this is the only way to recover these devices. That means a lot of (unneccessary) work.

Kind regards, 

Simon

[SimonGGS]

Hi,

the Update from iPadOS 16.6.1 to iPadOS 17.0.2 has not caused any problems on our test device. So the issue seems to be fixed. However, this works only for those devices that have not been updated yet.

[SimonGGS]

Hi,

today I got an updated of one of hour teachers, that there are once again iPads that are not online anymore and lost the profiles. Today and in the next days I am not in school and I cannot check if these iPads have updated from 16.6.1 to the old 17.0.1 or from 17.0.1 to 17.0.2 or from 16.6.1 to 17.0.2 but I would treat my previous statement on the result of the test on one Shared iPad with caution.

Meanwhile, I have created a ticket at Jamf School Support and I will update this threat as soon as I have new information.

Greetings, Simon

[SimonGGS]

I have another update: I can confirm that the issue still exists with iPadOS 17.0.2. Now we are wondering why it worked on our test device. Maybe it has something to do with the removal of our restrictions profile from the test device? I will update as soon as I know :)

[DHSchool]

Hi Simon,

I can also confirm that updating to 17.0.2 does not resolve the issues present.

We have manually connected one device group back to the Wi-Fi @ 17.0.1 - they have now all updated to 17.0.2 and have remained connected upon a restart.

Thanks for keeping me in the loop and I am glad I'm not the only one affected! Our restrictions profile seems to be unaffected, simply our wallpaper and Wi-Fi profiles...

[Sjet]

Same problem here.

[SimonGGS]

Hi everyone,

I have spent the last days with the support services of Apple and Jamf. 

Jamf is the opinion that the issue is iPadOS related and cannot be resolved by themselves.

Apple is the opinion that the issue is coming from Jamf. According to them the issue sounds like a certificate or something similar that is marked as expired with iPadOS 17 is used by Jamf. This would explain why only some settings are not applied and other devices like non shared iPads do not have the problem. The support said that only the reinstall of the devices will re-enroll those certificates. Another option was something that the MDM could do but unfortunately the support didn't go into details here.

However both support tickets are closed by now and we still do not have a solution. 

[EdwardB]

Hi everyone,

I had the same problems. Apple has a support document (https://support.apple.com/en-gb/HT213910) which implies that you have to clear the cache of the Shared iPad before upgrading (or erase the iPad). I tested this (from 16.6.1) and it worked. I lost the background but a reinstall of the profile solved that problem (as described in the article).

Can you confirm that the clearing the cache solves the problems for you?

[SimonGGS]

Hey Edward,

I am quite sure that I have cleared the cache on all Shared iPads before I initiated the update on the Shared iPads because I am always doing this.

Unfortunately, we are already in the holidays at the moment and I cannot test now. I can test it only in the mid of next week.

[OPete]

Hi,

some days after I ran into the iPadOS 17.x update issue (for shared mode iPads), Jamf shows a message (see picture) after the login to Jamf school - too late for me. I had to manually recover about 350 iPads, that costs me 4 days! Who pays for this lost time?

Btw. 80% of our iPads don't use user accounts in shared mode, only login as guest (temporary login), which can't be deleted. And, the message don't tell a word about the lost MDM connection! Does someone have a guilty conscience, Jamf? Thanks Jamf and Apple.

To avoid this for future 17.x / 18.x updates it would be good to know more details. Anyone who knows more?

Almost all iPads have downloaded and installed iPadOS 17.0.3, but finally something corrupted the update. No Wifi (could be activated manually), no background, and what is a no go, all iPads lost the complete connection to Jamf. 

[SimonGGS]

Hi OPete,

I've heard from a lot of schools that had the same issue. I think just everybody had to put a lot of configuration effort into this update with re-enrolling the devices and reassigning the profiles. I don't think that anybody will pay for the working hours we put into this. That such an issue even occurs is an absolute no go for business products!

I reached out to the Jamf support before and advised them to show a warning especially for the loss of MDM connection with the update of Shared iPads but they didn't care. They said it's Apple's fault. On the other side Apple stated, that this is an issue caused by the MDM (Jamf) and that Jamf is to blame for the error.

Apple has just released a support article https://support.apple.com/en-us/HT213910  where they show the message as it is displayed in Jamf School. But I'm quite sure that this does not fix the issue completely, as I had cleared the users from the iPads.

Maybe someone else has some information or any Jamf official can add something to this discussion.

[duxed]

I too assumed that clearing the cache was an important step for upgrading shared iPads to 17. However, reading the support note from Apple a couple more times to check, it actually says you have to "remove the existing users from the iPad before you upgrade". That sounds like an extra set of steps which implies disassociating the Shared iPads from all classes before you do the update. It isn't referring to the cache (which I wish I could manually trigger a cache write back). I'm about to this....

[duxed]

I'll retract that extra step theory. It is logging off and clearing cache...

[MarioStoehr]

Has anyone managed to update to IOS17.1.1? Clearing the cache didn't help. I hope you don't have to remove all classes too, right?

[duxed]

I've just done 10 remotely from 16.5.1

Ran into the issue where it seems that issuing a remote Log Off did not work. Issued the log off command and waited more than an hour, in some cases issuing multiple log off requests (Jamf School). Somebody on site had to manually sign everybody out. I was dealing with 64GB devices for the first time (usually 32GB) and seeing an increased wait time unclear to me whether this was due to the size of the cache files that had to be written back to iCloud.

I didn't think that log off had to wait for the cache to be written back. It still seemed to take a while.

After all devices are signed out (and you've checked remotely) you can go about clearing cache on each device.

From there I issued the update OS command for each device, rather than doing it by bulk. It was easier because I had to double check when the cache was cleared, again because of the delays.

Remotely, they eventually all updated. 

Some Wallpaper glitches / bugs have been introduced into 17. I've seen this on both Shared and non-Shared set ups which were working fine on 16. 

[MarioStoehr]

This still doesn't work for me.

I have an iPad 16.6 in front of me. I went to log out user, which he did. I deleted the cache, which he did. I checked in Jamf that there were no longer any in "Shared Users". Then I updated this iPad to IOS 17.1.1 and still the background remained black after it was finished and it no longer connected to the WiFi. Even if I manually connect it to the WLAN again via the GUEST access (I had to type in the code again), it doesn't establish a connection to Jamf, so I can't reset it remotely.

Everything is very annoying.. now I'm trying to remove the second iPad from all shared classes.

[FelixM]

Can you let us know if removing the shared iPads from the classes has helped?

[duxed]

You don't have remove any Shared iPads from classes. The Apple tech note which just says "remove accounts" is somewhat ambiguous. They seem to mean "remove account data".

[MarioStoehr]

And what exactly does it mean "remove account data" ?

[MarioStoehr]

I have removed the second iPad from all shared classes... so there were no longer any classes to select on the iPad.

Unfortunately the update didn't work either. Same problem - black background, no more WiFi. Even if I manually connect it to the WLAN again, it no longer communicates with Jamf.

If you switch these iPads off and on again, they try to install something every time they start up (apple logo with loading bar) - but they don't manage to do it after several runs.

Unfortunately I have no further idea of what else could be done.

[dletkeman]

We are utilizing Jamf School for our iPads, and we have over 3100 Shared iPads reporting that they have not yet upgraded to iPadOS 17. Generally, iPads will wait up to 90 days, as far as I understand, before attempting an automatic update unless it is forced or specific settings instruct otherwise. Considering that iPadOS 17 was released on September 18, 2023, the 90-day threshold is rapidly approaching. Consequently, around December 18, 2023, I anticipate that many of our Shared iPads will attempt the upgrade and potentially fail. I have contacted Jamf Success, and they have confirmed this concern.

If I had 150 Shared iPads, I would initiate the restoration process for all of them to ensure they are upgraded to iPadOS 17, providing a sense of relief. However, with more than 3100 iPads, this is not a feasible approach. Allowing the iPads to fail would necessitate individual restoration in recovery mode, rendering some iPads unusable until addressed. One potential solution could be to open a guest network for the iPads to be onboarded, providing users with information on how to restore their iPads themselves, although some users may not comply. Another option is to proactively instruct users not to use the iPads, have them plugged in, and over the next day or two, issue a delete cache command (wiping all user data), followed by an update command. This appears to be the most viable option.

How are others dealing with this issue?

I have contacted my Apple Technical representative, and he is currently investigating the matter.

This issue seems to be a significant bug. While it doesn't affect personal iPads, it poses a considerable challenge, especially as we approach the Christmas holidays.

[MarioStoehr]

We have the same problem... currently around 300 iPads have been manually updated to IOS 17 using Apple Configurator and there are still 1000 iPads to go. Apparently there will be no other solution.

I tried everything with clearing cache and removing classes, both on IOS 17.1 and 17.1.1. I can't confirm

17.1.2 yet, but I think nothing will have changed.

I also hear from others that they set everything up using the Apple Configurator.

A WiFi guest network won't help because the iPads go into a kind of installation loop during the update process and can't get out of it on their own. They no longer communicate with Jamf, which means you can't reset them remotely.

[rob_sieljes]

Hi dletkeman,

I've read in earlier posts that even wiping the user data doesn't prevent the iPad from losing connection.

We still have Shared iPads running iPadOS14 so I don't think the iPad will update automatically. So, don't update seems for now the best 'solution'.

If you want users to update the iPads, I did the following: in Jamf, assign a personal enrollment profile to the iPads en erase the iPads. The user has to: select language and region, connect to Wifi, enroll the iPad. Go to settings and update the iPad. When the update is installed: in Jamf assign the Shared iPad enrollment profile to the iPads and erase the iPads again. The user has to: select language and region, connect to Wifi, enroll the iPad (in other words make it a personal iPad, update iPad and make it a Shared iPad again).

[SimonGGS]

Hi, that's not ideal but sounds like a valid and interesting workaround. If the iPad is updated to iPadOS 17 you are able to wipe it without user interaction so only the first wipe / configuration (and update process) requires user interaction.

I can confirm that on our personal iPads no problems occured.

[dletkeman]

@rob_sieljes I had thought of this, but that's adding a lot more complexity and at least 2 wipes.  I'm not sure I even trust our users to plug in devices, let alone perform a restore.

Oh Apple, I love you, but why do you have to make my life so hard this time!!!!

[SimonGGS]

Hi dletkeman,

I hope you have more success with this update than I had. Unfortunately, I recently updated an iPad with empty cache and removed users and still faced the issue that the iPad did not communicate with Jamf. 

In your case, I would definitely plan that you need to connect the iPads with a Mac or something similar to reset these iPads to factory settings. I don't think you have another solution to reset these iPads if they are unabled to connect to the WiFi and I am not quite sure if you can reset them in the settings.

Nevertheless, without a reset, the communication with Jamf won't recover. Handing this over to users might be difficult.

From your standpoint, I would try to fix the bug in cooperation with Apple and stick to iPadOS 16 as long as possible or as long as the bug isn't fixed. Resetting >3000 iPads will be a lot of pain.

I think this bug is caused by the combination of Jamf (School) and iPadOS 17. In our district other schools use Intune from Microsoft as MDM and I did not hear about any issues with their Shared iPads and their update to iPadOS 17. 

[dletkeman]

@SimonGGS I think you are right.  I have seen indications that even clearing the user data still has some Shared iPads fail.  I agree handing this over to users is just asking for trouble.  I could push out a profile to delay adoption of iPadOS 17.  Over the summer I was able to single-handedly re-provision 2500 iPads by myself.  But that took 2 months and my back was killing me by the end due to lugging around a few Bretford Sync Stations.  I'd rather not repeat that again, but it looks like I may have to, with some help probably this time.

[SimonGGS]

Hi,

It is horrible that we need to bother with this and Apple is just ignoring the issue - as far as I can tell. 

Especially if Apple wants to focus on business deployments with their devices they cannot request from their users, companies and education facilities to reset all iPads once a year because their software contains bugs.

I hope you find a better solution that this with a bit more time and I think you may have more influence on Apple than I had. 

For my part I just reset all the iPads we had which took me 2-3 days and now everything is working fine again. Let's hope this will last a bit.

[dletkeman]

@SimonGGS At this point I'm leaning towards pushing out a deferred update restriction, but that can only be enabled for up to 90 days.  That will buy us some time.  Then systematically going school to school and restoring all Shared iPads.  This wasn't too bad during the summer because there was little to no network usage but with schools in use this may take longer.  We have 55 schools to work thru.  Some schools can be done in 1/2 day, others take a bit longer than a day.  So under ideal conditions by myself it would take two months to work through all schools.  Ideal doesn't happen so I wasn't able to get through all schools this summer, but if I hadn't taken vacation it might have been possible.

[MarioStoehr]

But that can't be a solution that we all have to reset the iPads manually... and then IOS18 then the same game again?

Es muss eine andere Lösung geben. Wenn wenigstens die iPads danach mit Jamf kommunizieren würden, könnte man ein Registrierungsprofil abgeben und sie können sich dann selbst wieder ins WLAN einwählen und es in ein geteiltes iPad umwandeln. Aber das ist leider nicht möglich.

Hat schon einmal jemand versucht, ein iPad komplett zurückzusetzen und dann iOS 17 hochzufahren? Bleiben sie bei der Installation hängen?

[MarioStoehr]

But that can't be a solution that we all have to reset the iPads manually... and then IOS18 then the same game again?

There has to be another solution. If at least the iPads would communicate with Jamf afterwards, you could hand over a registration profile and then they can dial back into the WLAN themselves and convert it to a shared iPad.. but unfortunately that's not possible.

Has anyone ever tried completely resetting an iPad and then booting up iOS 17? Do they get stuck in the installation process?

[dletkeman]

---

@MarioStoehr wrote:

Has anyone ever tried completely resetting an iPad and then booting up iOS 17? Do they get stuck in the installation process?

---

I'm not sure I follow this.  What do you mean?

[MarioStoehr]

Remotely reset a shared iPad using an enrollment profile. It resets itself completely, automatically dials into Wi-Fi and converts into a shared iPad. This means that no one has ever been logged in as a user on the iPad. And then in Jamf say update to IOS17.

I have never completely reset an iPad before an update process. So far I have only tried clearing cache and removing classes.

Maybe it will work if you completely reset the iPad first...

[dletkeman]

@MarioStoehr That may be valid but I don't know if I trust most of our users with that.  The workflow is valid though and it "should" work.  Maybe something to use in conjunction with my team's help.

[SimonGGS]

No, Shared iPads can reset themselves but after reset a user has to confirm the enrollment and select a language and region for these devices. One new feature of iPadOS 17 is taht one can issue a reset via MDM which includes an auto reenrollment feature. Only then the iPad skips the region, language selection and dials automatically back into Jamf. 

But this won't work for these iPads that are running on iPadOS 16. 

[EdwardB]

And unfortunately the Return to service option is only available for a single device. You cannot do this in bulk (yet, as I was told by Jamf)

[dletkeman]

@EdwardB Oooo!  I missed that option.  I like it.

https://learn.jamf.com/bundle/technical-articles/page/Return_to_Service.html

https://learn.jamf.com/bundle/jamf-school-documentation/page/Return_Device_to_Service.html

[MarioStoehr]

That's right, unfortunately this isn't possible as a mass operation yet. But I would like to know whether IOS17 will work with this variant.

If so, Jamf could certainly program in this mass operation fairly easily.

Users don't have to do anything, shared iPad does everything on its own. I've already tried it.. pretty cool feature.

I'm getting a few iPads next Friday, so I'll try that out.