Profile Manager - Push Profile stuck on sending

[mdench]

Profile Manager on our server when sending out settings / profiles seems to be getting stuck on sending. Some of the iMacs seem to have picked it up whilst others haven't. Does anyone else have this? Is it a client or server based issue? I thought they would pick up the profile after rebooting so rebooted a whole room (30 machines) and only 5 or 6 have picked up the settings. We have up to 19 tasks sat there "waiting" which are a mixture of user or machine settings.

[SovietRussia]

Its usually down to APNS, if it blocked in ANY way then the process won't go through, but if some machines get it,and some others that is wierd

 

APNS = Apple Push Notification Service, Port 2195 on gateway.push.apple.com

[mdench]

I have added gateway.push.apple.com to our whitelist categories and auth exceptions. Does a user setting task complete anytime or will it only process the task when a user logs in?

[SovietRussia]

I have added gateway.push.apple.com to our whitelist categories and auth exceptions. Does a user setting task complete anytime or will it only process the task when a user logs in?

 

Usually anytime

[mdench]

is most annoying -_-

 

 

[AntonioRocco]

Hi

 

If any of the ports listed in this article are blocked Profile Manager won't work properly:

 

OS X Server: Ports used by Profile Manager

 

2196 is the port used by clients trying to access APNS to 'receive' the 'pushed' (via port 2195) profile. Blocking or hampering access to both ports as well as 5223 may result in what you're seeing. It's possible APNS itself is having a problem? Has happened in the past. Although not definitive you can test access to APNS by clicking on the 'manage your certificates' section in the Server App for Push Notification Service. Log into the linked portal with the AppleID you used to set it up in the first place.

 

To test PM availability run a port scan on your MDM server internally as well as telnetting to the ports PM requires internally and externally.

 

However the fact that some of them are not receiving the profile but most do may indicate a network routing issue especially if your environment consists of multiple subnets. However I have seen this problem before some time ago and after testing everything suggested here the only 'cure' in the end was to blitz the macs involved. A bit drastic I know but if you've a well defined and crafted Mac deployment solution it should not take long?

 

Antonio Rocco (ACN)

Edited February 19, 2014 by AntonioRocco

[mdench]

We have setup the VLAN to be able to get out on any port that it requires, the macs and server are on the same VLAN 10.10.x.x

 

Will try the manager certificates thing in a bit