topic Re: Profile installation failed in Endpoint Security

Profile installation failed

nic_waller — Wed, 26 Jun 2019 21:59:17 GMT

I have been successfully provisioning macOS laptops with Meraki Systems Manager for the last 6 months, and everything was working fine until today. I think last time I provisioned a laptop was a few weeks ago. Today when I tried to add a new laptop I encountered this message from macOS System Preferences (Profiles):

> Profile installation failed.

> Could not authenticate to the MDM server. The credentials within the enrollment profile may have expired.

I searched the Knowledge Base in the Meraki app but came up with nothing. Nor could I find a relevant answer on documentation.meraki.com.

- How can I confirm (or refute) that the credentials in the enrollment profile are indeed expired?

- Is it possible that changing settings in the SM Console could have caused this?

Re: Profile installation failed

BlakeRichardson — Thu, 27 Jun 2019 00:01:13 GMT

@nic_waller is your Apple push certificate valid?

Re: Profile installation failed

nic_waller — Thu, 27 Jun 2019 04:00:01 GMT

Yes, the Apple push certificate is reported as valid in the admin interface.

Re: Profile installation failed

BlakeRichardson — Thu, 27 Jun 2019 20:24:40 GMT

@nic_waller How are you provisioning the laptops are you using DEP or Apple configurator?

Re: Profile installation failed

nic_waller — Thu, 27 Jun 2019 21:09:15 GMT

It turned out the problem was specific to one particular laptop that had recently been repaired at the Apple Store.

The laptop had been joined to Meraki MDM prior to going in for repair. The main logic board was replaced at the Apple Store, and although the serial number stayed the same it must have changed some other hardware identifier. After coming back from repair, the laptop was reformatted but was unable to join Meraki MDM.

The solution was to Delete (Remove From Network) the laptop from the list of Devices in Meraki Systems Manager. After that, I had no trouble re-joining the laptop into Meraki MDM. This was a surprise, because normally it's not necessary to delete device entries, as they automatically merge based on serial number.