macOS MDM Enrollment State

DESCRIPTION

macOS devices are unique, in as much as they may be managed by both the FileWave Client and Apple's MDM process.  The MDM Enrollment State is an inventory item which shows the current state of MDM enrollment.

FileWave requires the FileWave Client for basic management of macOS devices.  MDM is an additional extra to expand the management options, as provided by Apple.  There is no MDM only option for macOS devices.

INFORMATION

MDM Enrollment State

The state is a live report of the current status of the device's enrollment; imagine if a device was initially MDM enrolled, but the enrollment profile has been subsequently removed from the device.  Status values include:

• Full Enrolled – Device was MDM enrolled and all is good.  This would be usual for DEP or OTA
• Server only – Devices was MDM enrolled, but the device no longer has an enrollment profile installed
• Device only – Device has an MDM enrollment profile installed, yet the database has no reference of this
• Undefined – Device is running a version of FileWave older than 14.3.0 or has not yet reported back its state
• Not Enrolled – Device has never been MDM enrolled and is managed purely by the FileWave Client

Preliminary troubleshooting

Before contacting FileWave Support, use the state value to narrow where the mismatch is happening:

• Server only: FileWave has a server-side MDM record, but the Mac no longer has the FileWave MDM enrollment profile. Check Profiles/System Settings on the Mac for the FileWave MDM profile and note whether the device was recently archived, retired, wiped, migrated, or manually modified. Removing the MDM profile normally requires an MDM command, such as when a device is archived.
• Device only: The Mac still has an MDM enrollment profile, but FileWave does not have the matching server-side record. This usually means enrollment did not complete or the server record no longer matches the device. Check the profile install date, APNs topic, and the custom fields below, then re-enroll the device if the server cannot match it.
• Logs: On the FileWave Server, /usr/local/filewave/log/filewave_django.log includes MDM communication that can help explain enrollment and profile-removal behavior. DEBUG logging only helps for future actions after it is enabled, so collect the existing server log, the profile install time from the Mac, and any recent archive/re-enrollment actions before escalating.

DIRECTIONS

A query may be used to identify devices that are not in an expected state, for example, identify devices that no longer have an Enrollment Profile installed

An example query could look something like:

Add, edit or remove criteria to meet desired reporting.

ADDITIONAL INFORMATION

To assist identifying why a device may show as 'Device Only', the following Custom Fields may be added, reporting the Server Root Cert Name and the APNs of the enrollment profile:

MDM Server Root Certificate Name

Enrollment Profile APNs Topic