MP 7,1 Prohibitory sign on Mac Pro 7.1 after security update

[bsbeamer]

Install DriveDx after a successful boot. What does the report state for your boot drive after 24 hours of use?

DriveDx - the most advanced drive health diagnostics and monitoring utility

DriveDx - the most advanced drive health (S.M.A.R.T.) diagnostics and monitoring utility. Save yourself the data loss and downtime that is associated with unexpected SSD and HDD failures. Don't worry about losing your important data, music, and photographs.

binaryfruit.com

 

[ProfessorBong]

Interesting

Ok, so another update: Finally managed to reset the firmware with the Configurator 2, did a clean install of Catalina, and made sure it wouldn't security update automatically. Installed Creative Cloud, wanted to restart and boom: prohibition sign. So yeah, I'm done with this machine.


Well, I agree with you. Apple should fix this. But I haven't heard back from the support for almost a week now. I'm self-employed and just recently started my business. I have a deadline coming and I can't finish this project on my Macbook Pro alone. So basically right now I'm trying everything possible to get the Mac Pro running and save my business. If it was an iMac, I would buy another one right now. But a Mac Pro ist not exactly in the price range to buy a spare one just in case the other one fails, at least not for a start-up.

Is your prohibitory sign also coming up right after you try to log into your account? Or does it happen randomly after your Mac booted successfully?

If it happens when trying to log in, what is your boot log looking like in verbose mode? You can start in verbose mode by holding command + v after pressing the power button.

Check the screenshot in my original post and see if your errors are looking similar. Would be very interesting to know.

 

[ProfessorBong]

try this:

Same here, I did an SMC reset as described, but it didn't help. NVRAM reset didn't do anything either.

 

[ProfessorBong]

Install DriveDx after a successful boot. What does the report state for your boot drive after 24 hours of use?

DriveDx - the most advanced drive health diagnostics and monitoring utility

DriveDx - the most advanced drive health (S.M.A.R.T.) diagnostics and monitoring utility. Save yourself the data loss and downtime that is associated with unexpected SSD and HDD failures. Don't worry about losing your important data, music, and photographs.

binaryfruit.com

Tried this too already, and in my case DriveDx reports everything as ok with 0 issues found and 100% overall health rating.

 

[patrick.a]

Tried this too already, and in my case DriveDx reports everything as ok with 0 issues found and 100% overall health rating.

Same with me.

The sign appears after the log-in screen. Tried the verbose mode but it didn't show any errors and the Mac booted normally. Would need to try several times to reproduce the error but I can't right now. I'm so frustrated, I need a break from this computer. It's not even 1 year old. I shouldn't be the one troubleshooting!

Called Apple Care again as they didn't report back as promised. I didn't know the case gets reassigned to a new adviser every time you call. I actually liked my old adviser. Anyway, they are still investigating and can't tell me what's wrong with my computer. No way to speed this procedure up. He'll call me Wednesday next week. Leaving a customer with a broken machine for two weeks is unacceptable, especially in a business context in my opinion. But it doesn't seem to matter much what I think.

 

[ProfessorBong]

Really weird, it definitely should not be like that, especially since you have Apple Care. I don't even have Apple Care, plus my machine is 15 months old, but luckily in Germany the shortened 1 year Apple Warranty is not considered legal, so I'm still getting support under warranty. Also being a business customer.

In my case the first adviser I got through a phone call fully took on my case and is not getting reassigned. He's looking into it as well and we are in daily email correspondence. He's currently getting my boot log checked and will call back tomorrow morning.

I'm curious: how are they investigating your machine and your issue currently, if they don't have direct access to it and don't have a boot log from verbose mode?

 

[patrick.a]

Well... I didn't buy the Mac Pro through the Business Team and probably that was my mistake. But I emailed the local one here in Zurich an hour ago and maybe they can do something about it. I wouldn't mind that kind of service if it was my iPad. But for a Mac Pro it is a joke. Especially if the adviser promises to call me and then just doesn't for days. They don't seem to get what this machine means for me and my business.

I ran some Apple diagnosis software that created a 500mb .dmg with all the logs (and who knows what else...) from my machine. They are investigating that file. Apparently the team gave feedback that they need more time. And I'm guessing that means it's not a simple solution. My biggest fear now is, that it's software-related and they can't be bothered to fix it because they only sell very little Mac Pro. Like they did with the W5700X which is still not flawless in Catalina, at least not in my machine.

 

[ProfessorBong]

So I was on the phone with Apple support today and my adviser said the error messages in my boot log are very similar to those you would see when FileVault is not able to unlock your hard drive while booting. So he suggested it might be related to FileVault, and to test that theory I should turn it off. However, that would mean my Mac would need to decrypt the entire 2 TB SSD, which would take days. I will instead wipe the SSD, do a Time Machine recovery and when it’s done, I will choose to not turn on FileVault this time. Though even if I can then boot with no issues, I would still need a long term solution, since keeping FileVault off is not an option for me.

@patrick.a maybe your machine is also somehow struggling with FileVault since the security update. I assume you have it turned on as well?

 

[3SQ Machine]

So I was on the phone with Apple support today and my adviser said the error messages in my boot log are very similar to those you would see when FileVault is not able to unlock your hard drive while booting. So he suggested it might be related to FileVault, and to test that theory I should turn it off.

Sorry to bump but been chasing this intermittent infuriating issue down forever, did switching off filevault fix this?

 

[patrick.a]

So I was on the phone with Apple support today and my adviser said the error messages in my boot log are very similar to those you would see when FileVault is not able to unlock your hard drive while booting. So he suggested it might be related to FileVault, and to test that theory I should turn it off. However, that would mean my Mac would need to decrypt the entire 2 TB SSD, which would take days. I will instead wipe the SSD, do a Time Machine recovery and when it’s done, I will choose to not turn on FileVault this time. Though even if I can then boot with no issues, I would still need a long term solution, since keeping FileVault off is not an option for me.

@patrick.a maybe your machine is also somehow struggling with FileVault since the security update. I assume you have it turned on as well?

Yes, I do. But I did a reset of the T2 and have a clean install of 10.15.7 without the security update and it still happens. Deactivating FileVault permanently wouldn't be an option for me either but I might try it out when I'm back in the office next week. Very curios to hear if it helped in your case!

Another thought: If it really was a general problem with the security update, wouldn't there be many more reports about it here?

 

[dominicperry]

There are so many pieces of this jigsaw, and it's not reasonable to expect an end user to fix the problem.
There's the EFI firmware, the T2 firmware, not to mention complex partitions on the boot disk - if you study the file systems on Catalina and Big Sur, they are much more complicated than you would expect. Not to mention that it's almost impossible to actually delete the SSD and start again - in fact, if you do so you can end up with a bricked machine.
All you can do is call Apple, every day. Just don't let up. If you can visit an Apple Store with the machine, do that. Make a nuisance (pleasantly) of yourself - ask for a replacement, temporary or permanent. Tell them your business is suffering. Best of luck.

 

[ProfessorBong]

Yes, I do. But I did a reset of the T2 and have a clean install of 10.15.7 without the security update and it still happens. Deactivating FileVault permanently wouldn't be an option for me either but I might try it out when I'm back in the office next week. Very curios to hear if it helped in your case!

Another thought: If it really was a general problem with the security update, wouldn't there be many more reports about it here?

I haven't tried to reset my T2 yet, but from my understanding the Apple Configurator 2 refreshes the firmware with the most current one available (in case a firmware update before went wrong), which would then most likely be the same firmware that the security update 2021-02 installed already. So no change in this case. A reinstall of Catalina without the security update wouldn't fix it either. But I'm really only making an educated guess here.

Also I don't think the security update alone caused the problems for us, but more likely some other more specific factors (possibily linked to FileVault and T2) in conjunction with the update. Otherwise, as you said, there would be way more people reporting issues after the update.

 

[patrick.a]

There are so many pieces of this jigsaw, and it's not reasonable to expect an end user to fix the problem.
There's the EFI firmware, the T2 firmware, not to mention complex partitions on the boot disk - if you study the file systems on Catalina and Big Sur, they are much more complicated than you would expect. Not to mention that it's almost impossible to actually delete the SSD and start again - in fact, if you do so you can end up with a bricked machine.
All you can do is call Apple, every day. Just don't let up. If you can visit an Apple Store with the machine, do that. Make a nuisance (pleasantly) of yourself - ask for a replacement, temporary or permanent. Tell them your business is suffering. Best of luck.

Thanks for the encouraging words. They actually mean a lot. I've just booked a visit at the genius bar tomorrow evening and someone to help me carry the Mac Pro in his huge and heavy box through the city. I'll call them every single day from now on.

I haven't tried to reset my T2 yet, but from my understanding the Apple Configurator 2 refreshes the firmware with the most current one available (in case a firmware update before went wrong), which would then most likely be the same firmware that the security update 2021-02 installed already. So no change in this case. A reinstall of Catalina without the security update wouldn't fix it either. But I'm really only making an educated guess here.

Also I don't think the security update alone caused the problems for us, but more likely some other more specific factors (possibily linked to FileVault and T2) in conjunction with the update. Otherwise, as you said, there would be way more people reporting issues after the update.

I think your guess might be correct. But if it's software related they might not fix it. At least not quickly or maybe not at all for "old" Catalina. If that would be the case we'd be left with a machine that can't be updated anymore. That's actually my biggest concern right now because then I couldn't use the Mac Pro for work anymore.

 

[ProfessorBong]

Update: I turned off FileVault now (did it in system -> security after being hesitant, not through another time machine recovery). I expected decryption to kick in and take many hours to complete, however, to my surprise it did not decrypt anything at all. Instead the security panel said right away that FileVault is now turned off. I also confirmed it through terminal, which now states “FileVault: No (encryption at rest)” for my boot volume. I guess this is because with the new Mac Pro the SSD is always encrypted by T2. FileVault only changes the boot mechanism and requires the password before booting into the encrypted MacOS partition.

And the result? It fixed my boot issues! No more prohibitory sign. So I know now that it’s definitely related to FileVault. Tomorrow I will try turning it back on and see if I get the boot issues again.

@patrick.a I strongly recommend you try turning off FileVault as well before bringing your machine to Apple. It’s not a proper fix, but once it’s pinned down to FileVault there might be an easy solution.

This is a good read regarding FileVault and T2:

How FileVault and the T2 Security Chip work together in newer Macs

Macs with a T2 chip always encrypt their drives. Why is FileVault necessary?rn

www.macworld.com

 

[OkiRun]

Update: I turned off FileVault now (did it in system -> security after being hesitant, not through another time machine recovery). I expected decryption to kick in and take many hours to complete, however, to my surprise it did not decrypt anything at all. Instead the security panel said right away that FileVault is now turned off. I also confirmed it through terminal, which now states “FileVault: No (encryption at rest)” for my boot volume. I guess this is because with the new Mac Pro the SSD is always encrypted by T2. FileVault only changes the boot mechanism and requires the password before booting into the encrypted MacOS partition.

And the result? It fixed my boot issues! No more prohibitory sign. So I know now that it’s definitely related to FileVault. Tomorrow I will try turning it back on and see if I get the boot issues again.

@patrick.a I strongly recommend you try turning off FileVault as well before bringing your machine to Apple. It’s not a proper fix, but once it’s pinned down to FileVault there might be an easy solution.

This is a good read regarding FileVault and T2:

How FileVault and the T2 Security Chip work together in newer Macs

Macs with a T2 chip always encrypt their drives. Why is FileVault necessary?rn

www.macworld.com

It is only one data point ~
but our office 7,1 never had FileVault set to 'on' and we have not had issues with updates to Catalina.

 

[patrick.a]

Ok, so I can confirm that deactivating FileVault gets rid of the prohibition sign after log in as it gets rid of the whole boot-sequence that would usually follow the log-in-screen. That makes sense now that I understand how this whole T2-securitysystem works - thanks for the link to this article! But my Mac Pro still crashed again after 10 minutes and some stress tests. Maybe that's because the decrypting takes some time to finish in the background?

Leaving FileVault deactivated is not an option for me anyway. The Mac Pro carries all my data and I want to know they're safe when it sits in the office overnight.

 

[ProfessorBong]

Ok, so I can confirm that deactivating FileVault gets rid of the prohibition sign after log in as it gets rid of the whole boot-sequence that would usually follow the log-in-screen. That makes sense now that I understand how this whole T2-securitysystem works - thanks for the link to this article! But my Mac Pro still crashed again after 10 minutes and some stress tests. Maybe that's because the decrypting takes some time to finish in the background?

Leaving FileVault deactivated is not an option for me anyway. The Mac Pro carries all my data and I want to know they're safe when it sits in the office overnight.

There is no decryption happening in the background. Your drive is still fully encrypted and it stays that way even with FileVault turned off. What changes is that now pressing the power button on the Mac Pro to turn it on unlocks the drive immediately, while with FileVault turned on, the password is required to unlock the drive and mount your MacOS (which is exactly what fails in our cases and why the prohibitory sign shows up).

It is definitely not a solution to keep FileVault turned off when the machine is sitting in your office, but I’m sure there is a way to fix this. Why you’re getting random crashes after 10 min though probably has nothing to do with the FileVault issue and you might wanna bring your MP to Apple Service for that indeed.

 

[Bakafish]

It sounds like my laziness is rewarded again! I just turned off auto-update, it's been bugging me to reboot for a few weeks. Sounds like the latest security update is sub-optimal. Hope you guys get a good resolution soon.

 

[patrick.a]

Brought my Mac Pro to the Apple Store this evening. They'll run 8 hours of hardware tests and get in touch with the software-team which is currently still checking my diagnosis data. I thinks it's in very good hands now and it gives me peace of mind that it's out of mine.

 

[patrick.a]

Had another experience with the Apple support this morning: My level 1 adviser called to give me an update of what the software team had found out. He didn't know and seemed quite disappointed that my Mac Pro was not with me anymore as he wanted to run through some instructions to solve the problem. His plan was to reset some changes I made to the host-file and said if that'd fail, we would need to consider resetting the machine and reinstall Catalina from scratch. I told him that I've done that several times already and that it doesn't solve the problem. He kept repeating: We will see.

I was so frustrated by the lack of sympathy and competence that it took me a while to get over it. Apple business team advised me to buy the AppleCare Help Desk Support for 529 CHF extra because with that you get direct level 2 support and don't have to deal with level 1 advisers like him. I think this "extra" should come included with a machine like the Mac Pro.

 

[Ryan P]

Ya I posted on this, right after the security update was released.. I eventually ended up upgrading to Big Sur, as that seemed the fastest way to get my Mac Pro to boot up. Then I had performance issues with Parallels and Big Sur...so did a clean install of Catalina. Everything was fine.... install the security update...then bam... back to circle with a line through it. Like 1/10 boots would get me inside OS X.

What I noticed is that I could get to the first login screen...which is before the system starts the FileVault decryption...this is when mine would freeze. I disabled FileVault...and no issues in the couple weeks since then.

Glad to find it was not just me... I was really afraid it was some sort of motherboard issue with my Mac Pro..and I do not have Apple Care.

 

[patrick.a]

Thanks for sharing! This would have saved me a couple of days worth of troubleshooting had I known it two weeks ago. I suppose you didn't report the problem as you don't have Apple Care?

 

[davidec]

Intriguing, started having exactly this problem a few weeks ago with my 7,1 Catalina and everything up to date. Getting prohibited sign on every 3 or 4 start ups. First noticed Logic Pro hanging lots (unusual) and then not reopening. Click app but nothing happens, every other software seems ok. Reset machine and bang. 3 or 4 restarts then gets working again. Since a few of us are having the same issue makes sense latest security update has affected firevault which I have turned on. Next time I get the prohibited sign (I have just updated all my plugs and drivers) I will disable fire vault report back if that helps. So happy I found this thread, thought I was going mad.
PS - My MacPro 2018 has exactly the same software / OS etc and everything is fine there.

 

[ProfessorBong]

It's astonishing there is already 4 or 5 people on this forum reporting EXACTLY the same issue since installing this security update 2021-02, but Apple does not seem to be aware of it yet.
It is 100% clear this problem is caused by the security update in conjunction with FileVault.

@davidec: try disabling FileVault (it's done with one click, no decryption of your ssd is needed). Your system will boot with no issues after disabling it. But this shouldn't be a longterm solution. If your machine was to get stolen and FileVault was disabled, thefts have full access to all your data.

 

[patrick.a]

4 or 5 is not that many in comparison to all the systems with Catalina there are, is it? Still wondering if it affects all hardware or if it is somehow specific to some configurations.
Anyway, they better find out soon! My Mac Pro has been with them the whole week so enough time to test things out. But even if they‘d find the issue now I‘m really worried about how long it may take them to release another update to fix it. Might be too late for me.