macOS Enforce Patch Deadline fails when multiple update policies target the same deviceSolved

Hi @eleanor_a ,

Multiple active Enforce Patch Deadline commands for different macOS versions should not target the same device at the same time.

If a Mac receives deadline enforcement for multiple OS versions simultaneously, Apple’s native software update framework or the MDM/DDM update declaration can stall. This can result in actions remaining in Pending/In Progress, failed DDM activation status messages, or updates not starting even though the device is enrolled correctly.

Recommended cleanup:

1. Review the scopes of all macOS patch enforcement automations.
2. Remove the affected devices from older enforcement policies, such as earlier macOS update versions.
3. Ensure each Mac is targeted by only one active Enforce Patch Deadline policy at a time.
4. Cancel any stuck or pending Enforce Patch Deadline actions from the device Action History or Enforced Patches section, if available.
5. Restart the affected Mac, or restart Apple’s software update daemon with: sudo killall softwareupdated command.
6. Re-run the automation for the intended macOS version, or wait for the next scheduled automation run/check-in.

For deadline enforcement automations, they do not need to run continuously. Running them periodically, such as daily or a few times a week, is enough to schedule and enforce updates.

Regards,
Isabel Lora
Hexnode UEM

So if 26.6.1 is the current version we want everyone on, I should not also have the 26.6.2 deadline automation scoped to the same devices until we are ready for that rollout?

Yes @eleanor_a ,the safer approach is to use device groups based on OS version so devices enter and leave policy scopes automatically.

For example:

Phase 1: Move devices to macOS 26.6.1

• Create a device group where OS Version is less than 26.6.1.
• Scope the macOS 26.6.1 Enforce Patch Deadline automation only to that group.
• Once a Mac updates to 26.6.1, it no longer matches the group rule, so the enforcement payload is no longer active for that device.

Phase 2: Move devices to macOS 26.6.2 later

• Create a second group for devices that should receive 26.6.2, for example OS Version is equal to 26.6.1 or OS Version is less than 26.6.2 when you are ready.
• Scope the macOS 26.6.2 enforcement automation to that group with the intended rollout date/deadline.

This avoids overlapping enforcement commands and keeps only one target macOS deadline active per device.

Regards,
Isabel Lora
Hexnode UEM

We cannot run sudo commands on user Macs because standard users do not have admin permissions. Would asking users to restart be enough to clear the stuck update process?

Yes @shirleyc. If users cannot run Terminal commands with elevated privileges, restarting the Mac is the cleanest alternative. A restart clears the local softwareupdated process and helps remove any stalled state in Apple’s update workflow.

You can either ask users to restart manually or use Hexnode’s remote Restart Device action where appropriate:

Manage > Devices > select the Mac > Actions > Device Control > Restart Device

After the restart, make sure the older enforcement policies are unscoped and only the intended update policy is active before re-triggering the automation.

Regards,
Isabel Lora
Hexnode UEM

I also saw one Mac where the OS version in the portal was outdated and actions stayed pending even after Scan Device and manual sync. Re-enrolling that Mac fixed it, and enforcement started going through again. Is that related?

If a Mac has not checked in for a long time or actions remain pending despite a stable network, it can indicate a device-to-portal communication issue in addition to the update enforcement conflict.

For that scenario, check the last check-in time first. If the device is not communicating with Hexnode, it will not fetch new policies or execute pending actions. Re-enrollment can restore management communication, as you observed, but it is usually a recovery step after confirming normal sync and restart attempts do not restore check-in.

For devices that are checking in normally, focus first on removing overlapping macOS update enforcement policies and restarting the device/software update service.

Regards,
Isabel Lora
Hexnode UEM