Understanding Common Managed OS for macOS Errors

Learn about various errors that can be reported from Managed OS for macOS

"Fallback has been requested.", "Issuing Fallback.", and "Device will fallback within..."

Description

These messages mean that Kandji received an error from the device when attempting to enforce the update and has requested the Kandji agent to prompt the user to update or upgrade in System Preferences or System Settings instead.

Solution

When an error is reported to Kandji from the device, if it cannot be remediated, Managed OS requests the fallback experience from the Kandji Agent. This is expected behavior. See the "Installation Failure" section of this support article for more information on the fallback experience.

In all versions of macOS 13, a status of "Idle" is often persistently reported to Kandji after installation is requested and the update does not install. This is the most common reason these messages will be shown and the fallback experience will be initiated.

"Product key not detected. Managed OS will re-attempt later."

Description

When Kandji queries the device for available updates, it parses the response and looks for a matching product key that aligns with the latest approved version of macOS in Kandji. This is also known as "the library item version" (shown in the upper right-hand corner of the Library Item). When this error surfaces, the list of available updates returned from the device did not include a match for the library item version. 

Solution

This is often a transient error that will resolve itself on the next AvailableOSUpdates query (every 30 minutes) and/or device restart.

"OSUpdateStatus reported an error but did not provide details."

Description

When Kandji queries the device for the status of an update it scheduled, it parses the response to determine the best status to reflect in the web app. When there is an error, the OS usually includes an error code and details, but not always. When Kandji does not receive any additional information about an error, short of the fact that there was one, this message will be displayed. 

Solution

This is often a transient error that will resolve itself on the next attempt to install the update. However, if it persists, the device may be forced to enter the fallback experience for Managed OS.

"Device is not yet configured for RTC. Managed OS will re-attempt later."

Description

Kandji uses a highly scalable real time communication platform to notify the agent of OS enforcement. On new device enrollments, it sometimes takes a short while for the device to do its initial registration with our RTC service. 

Solution

This is normal and should be a transient error that will resolve itself on the next AvailableOSUpdates query (every 30 minutes). On initial enrollment, once RTC registration happens, Managed OS will also kick off just in time automatically. However, if this error persists longer than a few hours for a single device, please contact Kandji support.

"Only % battery remaining, and device is not connected to a power source."

Description

This happens when Kandji tries to initiate an update, and the device drops below 50% power or is not connected to a power source. The Kandji Agent checks for this requirement before kicking off an update. Still, sometimes due to the time it can take to install an update, the battery level can drop below the threshold once macOS starts to actually install the update.

Solution

Charge the Mac and/or connect it to a power source and try the update again.

"Device is Apple Silicon without bootstrap token.", "Waiting for device's bootstrap token. Managed OS will re-attempt later."

Description

This is a requirement in macOS to install software updates using MDM on Apple silicon. For more information on Secure and Bootstrap Tokens, see Apple Platform Deployment.

This is not a common issue as a Bootstrap Token should be escrowed automatically to Kandji during enrollment as long as the user doing the enrollment is a SecureToken enabled user or if Automated Device Enrollment is being used. This message may be displayed for a very short period of time after enrollment.

Solution

Log out or restart and log in as a SecureToken enabled user (of any type -- standard or admin), and one will be escrowed automatically to Kandji. You can confirm this by looking at the MDM section of the Device Details page. If the "Waiting for..." message is shown, it will often remediate itself shortly after enrollment.

Alternatively, the following can be run interactively by a SecureToken-enabled administrator on the Mac:

sudo profiles remove -type=bootstraptoken
sudo profiles install -type=bootstraptoken

Then try the update again.

Failed to personalize the software update. Please try again.

Description

macOS updates on Mac computers with the Apple T2 Security Chip and Apple silicon are personalized for each piece of hardware. For more information on this process, see Apple Platform Security. 

Solution

It's possible that a transient server issue happened with Apple's software personalization servers, or there may be a network problem contacting the hosts listed in the Device Setup section of this Apple support article. Check that connectivity is properly allowed to those services and try the update again.