Mac won't correctly shut down or restart - how to troubleshoot?

[LRSFC_DanJ]

Any suggestions on how to troubleshoot why a Mac won't shut down or restart (without forcibly holding down the power button)? We're pretty sure the cause is some software or configuration profile or setting we have installed, as it doesn't happen on a clean macOS with only Jamf and Sophos endpoint on it, but trying removing things and adding them back on one by one hasn't illuminated the culprit. Is there any log file or "log show" predicates that would help us isolate the cause of this? We're running macOS Monterey, mainly Intel Macs but I have also observed the issue on an M1 Mac Mini. One interesting artefact we noticed is that if we use the Shut Down or Restart buttons from the login window, we briefly see the Fast User Switching animation before the login window comes back again.

We're aware that wiping and upgrading/reinstalling macOS will probably make the problem go away but we'd really like to locate the root cause as this category of issue keeps coming back.

[Brimstone]

Do you have printer,scanner or graphics tablet drivers installed, are any of these plugged into the Mac?

[Mrpower]

Use to have a login / logout script that course a similar issue requiring a force shutdown / reboot. Have you checked in Utilities / Console for crash logs or just logs in general. Dose the Mac after reboot have a pop-up saying the Mac was restarted before a program ended, or something similar?

You could boot into safe mode and see if the issue returns. How to boot into safe mode https://support.apple.com/en-gb/guide/mac-help/mh21245/mac

You could rebuild and install MDM and anti-virus, one at a time to see what might be coursing the issue.

[LRSFC_DanJ]

Do you have printer,scanner or graphics tablet drivers installed, are any of these plugged into the Mac?

 

Yes, we have EPSON printer drivers and Wacom and Huion tablet drivers installed. However, on affected Macs, the issue happens regardless of whether a graphics tablet is plugged in.

[LRSFC_DanJ]

Use to have a login / logout script that course a similar issue requiring a force shutdown / reboot. Have you checked in Utilities / Console for crash logs or just logs in general. Dose the Mac after reboot have a pop-up saying the Mac was restarted before a program ended, or something similar?

You could boot into safe mode and see if the issue returns. How to boot into safe mode https://support.apple.com/en-gb/guide/mac-help/mh21245/mac

You could rebuild and install MDM and anti-virus, one at a time to see what might be coursing the issue.

 

We've tried to check logs but even just 2 minutes worth of logs around the time of the shutdown attempt amounts to 65,000+ lines, we don't know what to look for so it is a bit like looking for a needle in a haystack.

 

Yes, if we force power the Mac off then we will get the "You shut down your computer because of a problem" dialog after we boot it back up.

 

We've tried wiping and reinstalling things one at a time but this was unsuccessful in revealing the culprit of the issue.

[Mrpower]

We've tried to check logs but even just 2 minutes worth of logs around the time of the shutdown attempt amounts to 65,000+ lines, we don't know what to look for so it is a bit like looking for a needle in a haystack.

 

Yes, if we force power the Mac off then we will get the "You shut down your computer because of a problem" dialog after we boot it back up.

 

We've tried wiping and reinstalling things one at a time but this was unsuccessful in revealing the culprit of the issue.

 

Another idea, open Utilities / Activity Monitor and set it to CPU, try a restart and see if a running program crashes or has red writing next to the program. Alternative use "top" in terminal and it should show everything running and also might show a programming crashing. It does show programs sleeping and programs stuck, so it might show a program not responding.