QuickAdd package fails to install when Push Notifications turned on

[mkremic]

We have this bizarre issue in our environment (JSS 9.22) where if we have push notifications enabled, our enrolments for our OS X clients will mostly fail.

We can reproduce the results consistently. If we turn off push notifications in the JSS an enrolment will complete successfully. Turn them on and they will fail.

All the policies that are due to install on enrolment will complete successfully but it appears to fail to create the "profiles" entry in System Preferences. Interestingly enough if we reboot the OS X Client and run "sudo jamf manage" from the terminal, the client will pull down the certificate, enrol in MDM and the preference pane will appear in System Preferences.

Any thoughts on what might be the issue? I can confirm push notifications themselves work fine once the cert has come down, enrolled in MDM etc. It's just the initial QuickAdd package that's causing it to fail.

Any help/thoughts would be greatly appreciated!

Cheers

Michael

[mpermann]

Are you using Casper Imaging to image and enroll the computers or are you using some other method?

[emily]

We were having similar issues until we went into the JSS URL settings in Global Management and removed the "JSS URL for Enrollment Using Built-in SCEP and iPCU". Once we removed the URL and tried enrollment again, we didn't get a failure notice.

https://jamfnation.jamfsoftware.com/discussion.html?id=10080#responseChild56784

[mkremic]

@mpermann - We're just using the standard OS out of the box and heading to the enrolment URL

@emilykausalik - Unfortunately we didn't have anything specified in the "JSS URL for Enrollment Using Built-in SCEP and iPCU" field. I got hopeful when I read your post but it looks like that isn't it :(

[BenDenham]

@mkremic

Did you end up getting this sorted out?
I am currently having the same issue.

[mkremic]

Hey Ben, we managed to resolve it by using the built in JSS authority in PKI (Global Management). JAMF promised that it should work with our external CA however it never seemed to. I'd start there and test with the built in CA, if it works then try a new cert from your own CA and see if it fixes the issue. I'm yet to try our own CA again but will get around to it at some point.