munkey Posted January 8, 2020 Posted January 8, 2020 Hi All, A few months back we set up shared iPad trolleys (with the help on this forum!) employing AirWatch as our MDM. It was working fine for about 4-6 weeks then any changes made to students/teachers on Apple Schools (i.e. we wanted to add a new students) would not sync up with the iPads. I have synced AirWatch with Apple Schools and the changes show up in the AirWatch console but it never reaches the devices. We had issues, which is still not solved, that caused all our iPads to drop off our MDM and stop checking in around the same time every year so I went around doing a manual factory reset on every single iPad to get it to re-enroll. I really, really, don't want to do that again... I think this is a separate issue as the re-enrollment problem normally crops up during summer and the devices are still showing up as "recently seen" in AirWatch. Any ideas? Thanks!
bald_pig Posted January 8, 2020 Posted January 8, 2020 It does sound like your certificate has expired, would also cause the other issue you mentioned, if you renew it before it expires you won't have any issues. https://www.vodafone.de/downloadarea/Generating_and_Renewing_an_APNs_Certificate.pdf
munkey Posted January 8, 2020 Author Posted January 8, 2020 Thanks for the link, I hadn't heard of Apples push cert portal before. I just checked and it seems to expire in July 29th 2020 - I think that explains the yearly issue we have! That's one to add into the calendar... It seems as if apps and such are being pushed out fine, just not the Apple School's classes and students Ju [TD="class: standard"]Jul 29, 2020
bald_pig Posted January 8, 2020 Posted January 8, 2020 Unfortunately I don't use AirWatch, but I found this which has some details on shared iPads: https://docs.vmware.com/en/VMware-AirWatch/9.3/VMware%20AirWatch%20Integration%20with%20Apple%20School%20Manager%20v9.3.pdf
Brimstone Posted January 8, 2020 Posted January 8, 2020 Thanks for the link, I hadn't heard of Apples push cert portal before. I just checked and it seems to expire in July 29th 2020 - I think that explains the yearly issue we have! That's one to add into the calendar... It seems as if apps and such are being pushed out fine, just not the Apple School's classes and students Ju [TD="class: standard"]Jul 29, 2020 You also have to ensure that your VPP token and DEP Token are renewed each year, not just the Push token....
Brimstone Posted January 8, 2020 Posted January 8, 2020 And ensure you are using the new cert rules for iOS13.. https://support.apple.com/en-us/HT210176
RLR Posted January 8, 2020 Posted January 8, 2020 Can you see any pending commands on the iPads. I don't use airwatch but must be similar to Jamf. There should be an edu profile generated automatically from airwatch when ever any edu changes are made to classes. If you have a lot of devices/classes, this might take some time to generate (not thinking days here, maybe an hour or so). Do the classes look okay in Airwatch? Are you importing the new users into Airwatch from ASM?
munkey Posted January 10, 2020 Author Posted January 10, 2020 You also have to ensure that your VPP token and DEP Token are renewed each year, not just the Push token.... Yup the VPP and DEP are up to date. I spent yesterday digging around AW and found this profile signing cert https://imgur.com/a/jiAsSX2 Is this the same as the Push token? And ensure you are using the new cert rules for iOS13..https://support.apple.com/en-us/HT210176 How do I ensure I am using the new rules. Will it automatically do this when I renew? On another note, I noticed the time and date are all wrong on the shared iPads which may throw the certificates off. When I look at the local settings on the iPad it is set to automatically sync however this fails if the location services is turned off which appears to be a user-specific setting so I just spent a few hours logging into each user on each shared iPad and enabling location services for it to pull down the correct time. There has to be a way to enable location services from MDM so I don't have to do this each time a new user is added?
Brimstone Posted January 10, 2020 Posted January 10, 2020 Yup the VPP and DEP are up to date. I spent yesterday digging around AW and found this profile signing cert https://imgur.com/a/jiAsSX2 Is this the same as the Push token? No this is not the APNS token but could be the CSR? You download or follow a link to create the CSR from the MDM you are using, then upload this to Apple's APNS portal,here's how it is done using Jamf... https://www.youtube.com/watch?v=9l5ns2I2Fqg How do I ensure I am using the new rules. Will it automatically do this when I renew? This is server trust cert not the APNS Cert? On another note, I noticed the time and date are all wrong on the shared iPads which may throw the certificates off. When I look at the local settings on the iPad it is set to automatically sync however this fails if the location services is turned off which appears to be a user-specific setting so I just spent a few hours logging into each user on each shared iPad and enabling location services for it to pull down the correct time. There has to be a way to enable location services from MDM so I don't have to do this each time a new user is added? AFAIK There is no way to enable this remotely via the MDM currently, when you configure a predeployment set up stage in the MDM for DEP iPads you can ensure this gets turned on and then enable a restriction to stop it being turned off. Location services are critical for WiFi, Bluetooth and internet access.
RLR Posted January 10, 2020 Posted January 10, 2020 Yup the VPP and DEP are up to date. I spent yesterday digging around AW and found this profile signing cert https://imgur.com/a/jiAsSX2 Is this the same as the Push token? How do I ensure I am using the new rules. Will it automatically do this when I renew? On another note, I noticed the time and date are all wrong on the shared iPads which may throw the certificates off. When I look at the local settings on the iPad it is set to automatically sync however this fails if the location services is turned off which appears to be a user-specific setting so I just spent a few hours logging into each user on each shared iPad and enabling location services for it to pull down the correct time. There has to be a way to enable location services from MDM so I don't have to do this each time a new user is added? Nope, location services can't be controlled from the MDM. This is a restriction from Apple's end as their framework doesn't allow MDMs to control it.
munkey Posted January 13, 2020 Author Posted January 13, 2020 Ah, thanks for confirming - i'm 99% sure I enabled location services on the initial setup wizard you get put through during enrollment so it's strange it has disabled itself Well, ever since the time has been corrected to not be in the past most of the iPads have pulled down their new class lists which is good news. On a quiet day I will have to check if thats reflected across all devices.
RLR Posted January 13, 2020 Posted January 13, 2020 Ah, thanks for confirming - i'm 99% sure I enabled location services on the initial setup wizard you get put through during enrollment so it's strange it has disabled itself Well, ever since the time has been corrected to not be in the past most of the iPads have pulled down their new class lists which is good news. On a quiet day I will have to check if thats reflected across all devices. Someone may have gone into settings and turned it off?
munkey Posted January 17, 2020 Author Posted January 17, 2020 Oh dear, i'm back! (sorry) So now that users are syncing with ASM, I am now unable to deploy apps to the majority of devices! When I view the app install status from the devices list on AirWatch I get the message: Out-of-date. App assigned but not installed. I've tried pushing it out manually, rebooting devices, updating the app from AW and yet 90% of devices won't take it up even after several days. Any ideas? Thanks
Brimstone Posted January 17, 2020 Posted January 17, 2020 Oh dear, i'm back! (sorry) So now that users are syncing with ASM, I am now unable to deploy apps to the majority of devices! When I view the app install status from the devices list on AirWatch I get the message: Out-of-date. App assigned but not installed. I've tried pushing it out manually, rebooting devices, updating the app from AW and yet 90% of devices won't take it up even after several days. Any ideas? Thanks If the APNS token had expired before you renewed it then all iPads have to enroled again I'm afraid
munkey Posted January 17, 2020 Author Posted January 17, 2020 (edited) I just checked the APN token and it doesn't expire until mid this year. It's strange because a few iPads (which were enrolled on the same day) can install apps just fine. Here's a screenshot of the expiry: Edit: Here is the event logs for one of the iPads failing to install one of the apps. It seems to get stuck in a cycle of these two events. In this instance this log entry was created when I tried to manually force it to install Edited January 17, 2020 by munkey
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now