Apple MDM Missing Enrolment Profile
What
At times, MDM may appear slow or even worse, the MDM Enrolment Profile no longer seems to be apparent, preventing MDM management until re-enrolled.
Why
Apple observed that osquery can cause such issues, depending upon configuration.
osquery is a tool to describe a device based upon SQL and can be used by management tools or similar, e.g. Malware detection software. It is a popular tool, as highlighted by a couple of example applications that use osquery: CrowdStrike and Microsoft Defender.
If you use ADE/DEP to enroll the macOS systems you may find that the following command restores the device's belief that it is supervised and in MDM. To run the command you must be logged in on the device as it will launch a notification to click on to re-confirm that the device should be in MDM;
sudo profiles renew -type enrollmentInformation
FileWave does not use osquery, so that may appear as if devices managed by FileWave could be immune, however, since other 3rd party software may do so, FileWave device management, as with any MDM, could be impacted.
Consider testing for devices running osquery, where MDM issues may arise or MDM Enrolment Profile is no longer present. If so, it would be recommended to communicate with the software vendor utilising osquery. Details imply a reduction in the aggressiveness of osquery should prevent this. Additionally, Apple were looking into mitigating against this issue.
No Comments