iOS 11 MDM Lost Mode Issue

When MDM lost mode is applied to a device the only way to remove it is to DFU reset the device. We thought that the issue was resolved with iOS 11.0.1 but this was not the case for the iPad Air (original) or iPad Mini 2. Even running iOS 11.0.3 both devices are not able to get out of MDM lost mode. When disable command is sent, the device responds with: “MDM Lost Mode could not be disabled on this device.” Everything else seems to be ok, the device shows current location, plays lost mode sound just unable to exit lost mode.


Any idea when this will be fixed? Data loss is a big issue since the only way to exit is to DFU the device.

Accepted Reply

This seems to be fixed in the iOS 11.2 beta

Replies

This is only a problem on devices that are running ios 11 when they dont have the hardware to support the new touch id feature


You'll also notice that when you enable lost mode from your mdm server on these problematic devices that the command will return a response saying that it could not enable lost mode on the device - even though it actually does

And when you try to disable lost mode from your mdm server the command will say it cant disable it - and really cant


In the ios device logs you will see that there is an error similar to the below that happens after you enable lost mode and before you try to disable lost mode


Oct 12 14:47:54 iPad mdmd(DeviceManagement)[1056] <Notice>: Could not to disable MDM Lost Mode: NSError:

Desc : The device cannot be taken out of lost mode.

Domain : DeviceManagement.error

Code : 500

...Underlying error:

NSError:

Desc : The operation couldn\M-b\M^@\M^Yt be completed. (com.apple.icloud.FindMyDevice.EmbeddedOSSupport error 3.)

Domain : com.apple.icloud.FindMyDevice.EmbeddedOSSupport

Code : 3

...Underlying error:

NSError:

Desc : The operation couldn\M-b\M^@\M^Yt be completed. (BiometricKit error 4099.)

Domain : BiometricKit

Code : 4099

Extra info:

{

NSDescription = "";

}


I think the fact this error happens after enabling lost mode means it actually gets to enter lost mode

And the opposite is true for when you try to disable lost mode, the error happens before it tries to disable it so the command fails


I have a case open with apple but they are just telling me they cant reproduce the problem!

My guess is they arent following our steps to reproduce properly and they're using a device that supports touch id

Ive found out a little more after testing

The problem seems to be related to when you are in lost mode and you send the command to retrieve the device location, this then means the disable lost mode command will not work, only on the device models you said

If you only send the commands to enable lost mode then disable it will work fine. Which mdm are you using as it could be that its automatically retrieving the device location when lost mode is enabled


There doesnt seem to be a problem with running any other commands while in lost mode like the 'play sound' command, its only the device location command that causes this issue

This seems to be fixed in the iOS 11.2 beta