Understanding Common Managed OS for macOS Errors

By Katelyn Husvar

Learn about various errors that can be reported from Managed OS for macOS

"Fallback has been requested.", "Issuing Fallback.", and "Device will fallback within..."

Description

These messages mean that Kandji received an error from the device when attempting to enforce the update and has requested the Kandji agent to prompt the user to update or upgrade in System Preferences or System Settings instead.

Solution

When an error is reported to Kandji from the device, if it cannot be remediated, Managed OS requests the fallback experience from the Kandji Agent. This is expected behavior. See the "Installation Failure" section of this support article for more information on the fallback experience.

In all versions of macOS 13, a status of "Idle" is often persistently reported to Kandji after installation is requested and the update does not install. This is the most common reason these messages will be shown and the fallback experience will be initiated.

"Product key not detected. Managed OS will re-attempt later."

Description

When Kandji queries the device for available updates, it parses the response and looks for a matching product key that aligns with the latest approved version of macOS in Kandji. This is also known as "the library item version" (shown in the upper right-hand corner of the Library Item). When this error surfaces, the list of available updates returned from the device did not include a match for the library item version. 

Solution

This is often a transient error that will resolve itself on the next AvailableOSUpdates query (every 30 minutes) and/or device restart.

"OSUpdateStatus reported an error but did not provide details."

Description

When Kandji queries the device for the status of an update it scheduled, it parses the response to determine the best status to reflect in the web app. When there is an error, the OS usually includes an error code and details, but not always. When Kandji does not receive any additional information about an error, short of the fact that there was one, this message will be displayed. 

Solution

This is often a transient error that will resolve itself on the next attempt to install the update. However, if it persists, the device may be forced to enter the fallback experience for Managed OS.

"Device is not yet configured for RTC. Managed OS will re-attempt later."

Description

Kandji uses a highly scalable real time communication platform to notify the agent of OS enforcement. On new device enrollments, it sometimes takes a short while for the device to do its initial registration with our RTC service. 

Solution

This is normal and should be a transient error that will resolve itself on the next AvailableOSUpdates query (every 30 minutes). On initial enrollment, once RTC registration happens, Managed OS will also kick off just in time automatically. However, if this error persists longer than a few hours for a single device, please contact Kandji support.

"Only % battery remaining, and device is not connected to a power source."

Description

This happens when Kandji tries to initiate an update, and the device drops below 50% power or is not connected to a power source. The Kandji Agent checks for this requirement before kicking off an update. Still, sometimes due to the time it can take to install an update, the battery level can drop below the threshold once macOS starts to actually install the update.

Solution

Charge the Mac and/or connect it to a power source and try the update again.

"Device is Apple Silicon without bootstrap token.", "Waiting for device's bootstrap token. Managed OS will re-attempt later."

Description

This is a requirement in macOS to install software updates using MDM on Apple silicon. For more information on Secure and Bootstrap Tokens, see Apple Platform Deployment.

This is not a common issue as a Bootstrap Token should be escrowed automatically to Kandji during enrollment as long as the user doing the enrollment is a SecureToken enabled user or if Automated Device Enrollment is being used. This message may be displayed for a very short period of time after enrollment.

Solution

Log out or restart and log in as a SecureToken enabled user (of any type -- standard or admin), and one will be escrowed automatically to Kandji. You can confirm this by looking at the MDM section of the Device Details page. If the "Waiting for..." message is shown, it will often remediate itself shortly after enrollment.

Alternatively, the following can be run interactively by a SecureToken-enabled administrator on the Mac:

sudo profiles remove -type=bootstraptoken
sudo profiles install -type=bootstraptoken

Then try the update again.

Failed to personalize the software update. Please try again.

Description

macOS updates on Mac computers with the Apple T2 Security Chip and Apple silicon are personalized for each piece of hardware. For more information on this process, see Apple Platform Security

Solution

It's possible that a transient server issue happened with Apple's software personalization servers, or there may be a network problem contacting the hosts listed in the Device Setup section of this Apple support article. Check that connectivity is properly allowed to those services and try the update again. 

Took too long to find status for product key...

Description

In macOS 12.3 and later, the download progress of an update reported to Kandji by macOS may get stuck at 0%. Kandji has reported this to Apple in feedback ID FB9981183. 

Solution

After this error happens 3 times (over the course of 3 agent runs, or approximately 3 hours), the agent will proceed with assuming the update is properly downloaded, and the user will be prompted to install the update.

To reduce the frequency of this error, turn off the option to automatically download updates in any Software Update Library Items being used in the same Blueprint(s) as Managed OS for macOS. Managed OS automatically downloads updates 5 days in advance leading up to enforcement.

The ScheduleOSUpdate command failed

Description

This is a generic error that can have many causes. One may be that in macOS 12.3 and later, users may receive an additional notification with a countdown timer when an update begins the installation process. This notification appears on top of the Kandji agent notification, as shown here:

If this notification is interacted with by a user and dismissed, the update does not proceed. Kandji has reported this to Apple in feedback ID FB9981183.

Solution

Restart the device and try the update again.

Unsupported InstallAction for this ProductKey

Description

macOS 11.x only returns full installers to Kandji, instead of both full installers and delta updates, the first time it is queried for updates. When Apple has a full installer available for the same macOS version that is currently approved for minor updates, this error may occur.

Solution

This error should resolve itself after ~30 minutes once an affected device receives its next query for available updates and the Kandji agent checks in after that second query. This is also resolved in macOS 12 and later.

An error occurred executing this item: command failed: unknown error

Description

This is a generic error that can have many causes.

Solution

Restart the device and try the update again. Contact Kandji support if this error persists.

Couldn’t communicate with a helper application/Helper tool crashed

Description

Kandji has observed frequent occurrences of this error when upgrading macOS Big Sur clients running a macOS version less than 11.6.4 to macOS Monterey, and has filed it with Apple in feedback ID FB11546032.

Solution

Update the device manually to the latest version of macOS Big Sur using System Preferences, and then try the update again.

Errors referencing startosinstall

Description

The macOS full installer's startosinstall tool is used to upgrade Intel-based Mac computers between major OS versions. Errors referencing startosinstall may indicate a problem with the download of the installer, or the usage of it, depending on the error. 

Solution

Check the device's network connection. Restart the device and try the update again.

Device is not supervised.

Description

Supervision is required for Managed OS; if the device is not supervised, this is expected behavior. Learn more about supervision from Apple, here.

Solution

Re-provision or re-enroll the device.

I need more help

Contact Kandji support for additional help with Managed OS.