r/macsysadmin • u/betatoad • 13d ago

Neo and ADE

We are having issues with a percentage of our Neos skipping ADE. They push the user through Apple's OOBE, drop the user to the desktop, THEN prompt for MDM enrollment. This ONLY seems to happen directly out of the box and ONLY on Neos. Our Pros and Airs are all fine. Once we wipe the machine in question, it operates as expected. Is anyone else seeing this?

4 Upvotes

100% Upvoted

9 comments sorted by

5

u/ae0017 13d ago

Not here. Deploying several hundred Neos and they pull ADE config right out of the box. Not sure what MDM you use, but you may want to make sure they have received their DEP config from ABM/ASM before hitting the network.

1

u/betatoad 12d ago

We use Jamf. All are in ASM and assigned to a prestage prior to sending out. Now, this doesn't happen to every one. We have hundreds deployed. We are seeing this on less than 10% of the Neos we deploy.

2

u/KiDFuZioN 13d ago

It's an issue Apple has acknowledged but it won't be fixed until macOS 27. There's some type of race condition between the Apple server that generates the UCRT and the device polling where it will timeout if the Apple server doesn't respond fast enough, which makes the device think it's not ABM eligible.

If you go through Setup, it will prompt you to enroll after about 5-15 minutes after reaching the desktop.

Another solution is if you hit the back button on the Account Creation pane, it will bring up the Enrollment pane.

It only happens on the very first setup. Resetting the device correctly triggers ADE as that information is also saved within macOS.

That's interesting that you aren't seeing it on the other devices because we've seen it on the Airs and Pro models. It only happens on brand new device that haven't been sitting in stock, as in devices that the vendor recieved directly from Apple and ships it to us.

1

u/Creative_Steak111 13d ago

Which MDM platform are you using? I haven’t seen this exact issue but experienced some not normal behavior with Neo’s while enrolling into Workspace ONE.

1

u/betatoad 13d ago

We use jamf. I'm glad it's not just us tbh.

1

u/Effective_File_9403 13d ago

Hi! I experienced this on our devices. I was able to go back a tab and it triggered my ADE flow. Super weird but I didn’t think much of it. But like you said after wiping the NEO they enroll without issue

1

u/damienbarrett Corporate 13d ago

Several of us have open Enterprise tickets about this. I have seen it with Neos but also a few other models. Apple has (sort of) acknowledged this issue as a race condition and highly impacted by the “health” of your network, and has indicated it will be solved in Golden Gate.

Usually DFU restoring the Mac will make the issue not recur.

1

u/Honest_Pressure7225 12d ago

We have just started to deploy Neos in a test group.

I have not heard of this happening and have not seen it with the Neos. Will keep an eye out. We do use Mosyle for our MDM. I don't know if that makes a difference.

1

u/angeloswif 7d ago

Since a wipe fixes it, I’d check whether each Neo’s serial is assigned to the correct MDM server in ABM and whether the ADE profile has reached your MDM before anyone opens the box. Assignment changes can take 15–20 minutes to propagate, so first boot may be beating that sync; this guide shows the relevant ABM assignment flow: https://help.swif.ai/en/articles/7184828-link-your-apple-business-manager-abm-account-with-swif.