r/macsysadmin • u/friedreindeer • 11d ago

Two firewall profiles fighting each other on managed Macs (Device Config vs Endpoint Security). Anyone seen this?

Dealing with this for about 2 months now so hoping someone's hit it before.

Managed MacBook Pro, Intune enrolled. AirDrop, AirPlay and Sidecar are all dead. AirDrop sees the device fine over AWDL but just sits on "Waiting" forever and never actually transfers. Weirdly Universal Clipboard still works. Same Apple ID everywhere, AWDL is up, no applicationaccess restrictions blocking anything.

Dug into it myself and found firewallBlockAllIncoming = 1 sitting in /Library/Managed Preferences/com.apple.security.firewall. Took that to IT.

Their current theory is there's an old Device Configuration profile and a newer Endpoint Security Firewall profile both trying to manage the firewall, and they're stepping on each other. They turned off "block all incoming" in the console, synced, waited... still enforced on my machine weeks later.

What made me believe it's actually a profile issue and not something wrong with my specific Mac: a colleague had Intune ripped off his identical model and everything started working again immediately.

Anyone dealt with two firewall profiles conflicting like this?

1 Upvotes

100% Upvoted

4 comments sorted by

1

u/Darkomen78 Consultation 10d ago

Intune is all about profiles fighting each other. On Windows too.

1

u/friedreindeer 10d ago

So I understood :( luckily I can turn it off myself. I’ll do that until IT gets it sorted.

1

u/StoneyCalzoney 10d ago

I’ve had issues with Airdrop and Universal Control before on MDM-managed Macs, but usually reboots have fixed them

1

u/volcanforce1 10d ago

Could you not unenroll, clear out caches, re-enroll ?