Troubleshooting Apple M1 devices

This troubleshooting doc describes some of the common issues that may arise while dealing with Apple Silicon (M1) devices.

1. Kernel Extensions and Software Updates Warning

Enrolling a Mac device outside of Apple Business/School Manager prompts a warning message “This MDM server requests the ability to manage kernel extensions and software updates. To allow this, reboot into Recovery and enable MDM management in Startup disk” under System Preferences > Profiles.

Reason:

Mac with Apple Silicon chip runs with the highest security level called Full Security to safeguard them from tampering. As a result, installing legacy system extensions (or KEXTs) on a Mac requires the security policy to be changed to Reduced Security.

In the case of devices enrolled in a UEM solution, Kernel extensions and software updates can be managed directly from the UEM console. Yet, it requires the device to be enrolled in Apple Business/School Manager to automate the authentication. If otherwise, it prompts a warning to grant permission for the MDM to manage kernel extensions and system updates.

Solution:

You can streamline the remote management of KEXTs by changing the security level used on the startup disk.

1. On the macOS device, click on the Apple menu.
2. Choose Shut Down.
3. Hold down the power button until the device shows ‘Loading startup options’.
4. Select Options > Continue.
5. Choose an administrator account and click Next.
6. Now, authenticate the user account. Click Continue.
7. Select Utilities > Startup Security Utility on the Recovery app.
8. Choose the startup disk.
9. In case FileVault is enabled, click Unlock. Enter the password to unlock.
10. Click Security Policy.
11. The following security options are available:
    • Full Security: Choosing this option helps ensure that the device runs only the current OS or signed operating system software currently trusted by Apple.
      
      Note:

      This security level requires a network connection during software installation.
      

    • Reduced Security: This option allows any version of signed operating system software ever trusted by Apple to run.
12. For Reduced Security, you may also configure the following settings:
    • Allow user management of kernel extensions from identified developers: This option permits you to install software or applications that use legacy kernel extensions.
    • Allow remote management of kernel extensions and automatic software updates: This option authorizes remote management of legacy kernel extensions and software updates using Mobile Device Management (MDM) service.
13. Click OK.
14. Next, click on the user pop-up menu, choose an administrator account, enter the password for the account, then click OK.
15. From Apple menu, click Restart.

2. Executing the Lock Device action reboots the device into the recoveryOS

Case:

The Lock Device action executed on a Mac with Apple Silicon and running a version of macOS 11.5 or below causes the device to boot into recovery.

Solution:

You can use an administrator account to reactivate the device, provided the device is connected to a network. However, the user authentication requires a Secure Token enabled on this account.

3. The device becomes unresponsive

In certain instances, for example, during a macOS update or upgrade, the device may become unresponsive.

Solution:

There are two ways to overcome this situation:

• Revive the Mac
• Restore the Mac (If revive is unsuccessful)

These solutions help you update the firmware and recoveryOS to the latest version.

Reviving a Mac with Apple Silicon

Step 1: Connect the Mac computers

1. Connect the macOS devices with a supported USB-C cable.
2. Open Apple Configurator 2 on the secondary device.

1. Hold the power button of the primary device. At the same time, continue pressing the following keys for 10 seconds.
   • Right Shift key
   • Left Option key
   • Left Control key
2. Then, release the three keys while holding its power button. Continue to press the power button on the primary device until the DFU icon appears on the secondary device.

Step 3: Revive the firmware and install the latest recoveryOS

1. On the Apple Configurator window of the secondary device, click on the DFU icon.
2. Control-click the DFU icon on the Apple Configurator window.
3. Choose Advanced > Revive Device > Revive.
4. Once the process completes successfully, the primary device reboots.

1. On the Apple Configurator window of the secondary device, click on the DFU icon.
2. Control-click the DFU icon, choose Actions > Restore.
3. Click Restore.
4. After the process is completed, the primary device restarts.
5. If the steps mentioned above succeed, the primary device shows the macOS Setup Assistant. Otherwise, you may repeat the restore process.

4. Updating or installing macOS on the device raises an error

The error message may occur while downloading, preparing, installing, etc. The sources of the error can vary.

Solution:

If the error message itself recommends a solution, you may proceed with it.

Here are a few solutions that aid you through the process of updating or reinstalling macOS when the devices raise an error.

• Re-check the network connectivity

  The device needs to be connected to the internet to fetch the firmware and other device-specific details. Thus, verify that the device has stable internet connectivity.

• Install when the device starts up safe mode
  Try installing macOS while the device starts up in safe mode.
  1. Shut down the device.
  2. Turn on the device. Continue pressing the power button until the startup options appear.
  3. Choose the startup disk.
  4. Press and hold the shift key and choose Continue in Safe Mode.
  5. Next, log in to your Mac.
• Install after repairing the disk

  You can use the Disk Utility to repair the startup disk.

  1. Open Disk Utility on the device. You may either open it from Utilities or open it from macOS recovery.

     To open Disk Utility from macOS recovery,

     • Turn on the device.
     • Continue pressing the power button until the startup options appear.
     • Choose Disk Utility and press Continue.
  2. Choose the disk from Disk Utility.
  3. Repair volumes, containers and disks, respectively.
     • Choose the last volume on the disk.
     • Click on the First Aid button.
     • Click Run.
  4. After running the first aid of the given volume, choose every other volume in the disk, every container on the disk and finally the disk and repeat the process individually.
  5. Quit Disk Utility. Now restart the Mac.
• Install from macOS recovery

  Try installing the update as the device starts up from macOS recovery. To start up the device from macOS recovery,

  1. Turn on the device.
  2. Continue pressing the power button until the startup options window pops up.
  3. Click the gear icon labeled Options.
  4. Click Continue.
  5. On the macOS recovery screen, select Reinstall macOS.
  6. Click Continue and follow the instructions displayed on the screen.
• Install using a bootable installer

  You may also use an external drive or secondary volume as a startup disk to install the macOS operating system.

  1. Plug the bootable installer into the device connected to the network and compatible with the version of macOS being installed.
  2. Turn on the device.
  3. Continue to hold the power button until the startup options window shows up. It displays all the bootable volumes.
  4. Select the volume containing the bootable installer, then click Continue.
  5. When the macOS installer opens, follow the on-screen instructions.

5. Rosetta is not installed by default or gets removed on Apple Silicon/M1 Macs

Rosetta enables Apple Silicon Macs to use apps built for Intel-based Macs by translating Intel x86_64 instructions to the ARM architecture of Apple Silicon.

Cases:

• Apple has removed support for the pre-installation of Rosetta 2 on Apple Silicon Macs. If Rosetta isn’t already installed on the M1 devices:
  1. A prompt to install Rosetta will be displayed when a user tries to open an app supported only on Intel processors.
  2. The installation will fail when a user tries to install an app or package supported only on Intel processors.
• Rosetta may be removed from the device during system updates with the message “Rosetta will be removed upon installing this update.”

Solution:

Install Rosetta on Macs by running a custom script from the device terminal or using the Live Terminal feature from the Hexnode UEM console.

You can also install Rosetta remotely using the Execute Custom Script feature from Hexnode UEM console.

Refer Mac admin’s guide to Rosetta 2 for a detailed walk-through.

6. Certain apps are not working on Rosetta-installed Macs with Apple Silicon

Case:

Rosetta enables the translation of most Intel-based apps to the ARM architecture of Apple Silicon. However, Rosetta cannot translate virtual machine apps that virtualize x86_64 computer platforms.

Solution:

Refer to the Apple Silicon Macs guide for validating third-party software with native Apple silicon support, those that work with Rosetta 2 only and those not working with M1 Macs.