PENDING SCCM Mac Enrollment error

[Yaseen Kriel]

I am trying to configure client settings within SCCM for MAC enrollment and when I get to the part where I have to set up the profile I get the following error:

 

[Youssef Saad]

Hi Yaseen Kriel,

Do you already created a authenticated session certificate template on you PKI server? Refer to this: (1) and this (2).
The installation of your inscription point and your inscription proxy point was successfully?

 

[Yaseen Kriel]

Hi Yaseen Kriel,

Do you already created a authenticated session certificate template on you PKI server? Refer to this: (1) and this (2).
The installation of your inscription point and your inscription proxy point was successfully?

Yes, the enrollment installations were successful.

 

[Youssef Saad]

Can you see the certificate in this?

 

[Yaseen Kriel]

Can you see the certificate in this?
View attachment 1084

the space is empty

 

[Youssef Saad]

Can you check in your Management Point Properties if the option for support mobile device and MAC computers is enabled?

 

[Prajwal Desai]

Can you double check if Mac client certificate template is created ?.

 

[Youssef Saad]

Any news?

 

[sconway]

Hello Guys, i have a problem, i have recreated all the certificates on our serves, but the macs still get the following error (see attached). can you help.

 

[Youssef Saad]

Did you change the certificate for the inscription of your MAC clients on your Default Client Settings?

 

[sconway]

Yes i have.

 

[Youssef Saad]

Try this :

0x80180026 – Device is ExternallyManaged

This occurs when a device is locked in ProvisioningMode. Repair this by changing the following registry key:

HKLM\Softrware\Microsoft\Enrollments\ExternallyManaged, set the key equal to 0.

 

[sconway]

Hello Youssef, this is on a mac, not a PC.

 

[Youssef Saad]

I know it Change this on the server that contains Inscription Point.

 

[sconway]

Hello Youssef, thats all working now, but now i get the following: The devices enroll, but it says certificate no found, and on the server i get this:

MP Control Manager detected management point is not responding to HTTP requests. The HTTP status code and text is 403, Forbidden.

Possible cause: Management point encountered an error when connecting to SQL Server.
Solution: Verify that the SQL Server is properly configured to allow Management Point access. Verify that management point computer account or the Management Point Database Connection Account is a member of Management Point Role (smsdbrole_MP) in the SQL Server database.

Possible cause: The SQL Server Service Principal Names (SPNs) are not registered correctly in Active Directory
Solution: Ensure SQL Server SPNs are correctly registered. Review Q829868.

Possible cause: Internet Information Services (IIS) isn't configured to listen on the ports over which the site is configured to communicate.
Solution: Verify that the designated Web Site is configured to use the same ports which the site is configured to use.

Possible cause: The designated Web Site is disabled in IIS.
Solution: Verify that the designated Web Site is enabled, and functioning properly.

Possible cause: The MP ISAPI Application Identity does not have the requisite logon privileges.
Solution: Verify that the account that the MP ISAPI is configured to run under has not been denied batch logon rights through group policy.

For more information, refer to Microsoft Knowledge Base article 838891.