So hi all let's summarize this topic as I've got the same problem (across all my devices: M1 MBA, M1 MacMini, Intel 27'' imac i5), i can confirm the following:
- problem appears on both Intel and Silicon macs (M1 to Max) though Apple Silicon macs seems to be affected the worst.
- underlying bug or parts thereof also present in last 3 Big Sur releases.
- formatting of the drives does not matter*
- message about a mac being locked therefor backup is unable to finish, while computer is actually unlocked and in active use**
- problem may appear/disappear intermittently on affected macs.
based on this i have come to the following conclusion, while consulting with an Apple Netherlands rep:
a user security eval triggers an internal though abnormal macos security process/policy, locking out certain system functions, including but not limited to backups with TimeMachine, Apple Pay, Touch ID, App Store confirm with TouchID, Watch Unlock etc.
let me explain:
when using certain software (EX. Rogue Amoeba AirFoil etc), docks, DAC's or other tools and even chargers a signed kernel extension may necessarily be installed on the mac which requires lowering macos security policy to
Reduced Security to get the kernel extensions to run at boot/login and allow the developers to update them, while not everyone in this thread may have those installed, this seems to be the main causer of these headaches especially on M1-Series macs..
Somewhere in this process macos is conflicting with itself, resulting in the loss of or partial loss of off backup functionality, disabled apple pay on macs and other security restrictions in the user space of macos, as listed above.
Now, I've discovered in my testing that there are 2 main triggers for these lockouts:
- you may have third party kernel extensions or pseudo-ones*** on your system without knowing it, for example if you've ever used a high watt charger for your mac, installed certain gaming software, or otherwise used software which acts as a virtual drive, disc or audio device****, like the software from rogue amoeba mentioned above, as those install hooks into macos which require the reduced security policy for them to load either as a traditional kernel extensions or pseudo-extension, which aren't actually loaded but still need to be installed.
- recently connected new hardware such as external drives or other devices and/or certain software installations.
If you believe it's none of the above, please share your experience as the bug may be even more pernicious and have multiple if not more root causes.
So then, onto my situation, I was frequently having to return to macOS Recovery to change the security policy back and forth, sometime this resulted in time machine and apple pay to get working again other times not.
Now, what machines do i have: I currently write this on my M1 MacBook Air running the non beta 12.0.1 of monterey.
My macMini still runs the last version of Big Sur, my iMac is on monterey non beta as mba above.
imac and macmini backup to a time-capsule where the imac only fails some backups as of the update to monterey, while the macmini refuses to complete a backup if i purposefully trigger the process by installing a software or hardware with a kernel extension necessitating some round-trips to macos recovery to flip the setting, then backups start again.
(on these macs i didn't run any beta this time around)
but now my mba m1, it seems so far to be the one affected the worst, on this device i've run all betas of monterey, up until the final release of monterey, then switched dev beta off. (i'm currently planning to put 12.1 beta on to see if that fixes things)
during the summer beta phase, this m1 mba experienced these issues the heaviest and also intermittently and seemingly randomly, sometime resulting in no backups at all for a week or more, before i even discovered it when looking at the date of last backup in sys preferences. all the while, the menu bar icon did change and indicate a backup progress every so often during that week, as macos normaly does its automated tm backups, but of course failing to complete the backup each time, before i actually discovered it. had i had critical files on this mba, i surely would have lost a few of them.
So..
As of today, timemachine is again refusing to complete backups, my last backup is from 00:54 at midgnight today.
it starts the process of copying files, sometime i even see a new folder appear on the drives, sometime with an .interrupted on the extension, other times, no apparent action takes place on the timemachine volume, other than system preferences and the menu bar item both showing a backup to be in progress.
and the only apparent change to this m1 mba was connecting a new seagate external drive to format it.
That is all. But apparently enough to interfere with both time machine and apple pay again, as both are now refusing to work as they're supposed to, with apple pay in syspref having a message of "card not available as this mac's security settings have changed'.
In any case, flipping full security back on in macos recovery, immediately restores the stored cards and apple pay becomes available again, but then of course, my kernel extensions are disabled such as those for my dac, dock and other hard/software.
to conclude: this bug if you can call it a bug has a complex root cause if not multiple causes and also multiple consequences.
- * time capsule is formatted as HFS+, M1 MBA backups to a local thunderbolt 3 drive enclosure when plugged in^, and those are in APFS, as those only started their duty of timemachine for the M1 MBA since i got it, and Big Sur formaated them to APFS without me even having the choice of something else
- **earlier in the thread a few of you also reported this message too, this likely is the same security eval bug I explained above, and I directly checked apple pay when the time machine pref-pane gave me this specific error (some time last week), and yes, apple pay was disabled as well, a reboot to macos recovery and a change in security policy again fixed both things, while leaving my extensions disabled for that time, which eventually fixed it self when i again restored the Reduced Security setting. (until today {see above}, both time machine and apple pay were working fine in that mode on my mba m1 again)
- ***what I call pseudo extensions are those that are installed by say your dock, raid enclosure (both hw/sw ex. softraid by owc), or thunderbolt docks/hubs like those from CalDigit or virtual devices for specific video and audio software which do emulation or capturing, you can check them through system profiler when going to about this mac, then software > extensions. notice they are most likely not actually loaded by macos when you're logged in, but exist in a semi loaded state, and really only require to be installed for the software such as the Caldigit dock ejection utility or raid enclosures (like those from owc or others) to function.
- ****for example software from rogue amoeba installs the ACE component to hook into coreaudiod, which to macos acts like a kernel extension requiring the lower security setting, but isn't actually a typical kernel extension which loads when you login, the software of this company only requires it to be authenticated by the system and approved, they use the kernel extension method to accomplish this. which normally doesn't effect macos, unless there is a bug underlying in the security routine of macos which we now experience with monterey and on M-Series macs in particular.
only good news is, apple is likely already working on a fix for monterey and as far as the methods these software and hardware companies use to hook into macos for their functionality: they are on their way out and will need to be replaced by another method, as apple is moving away from allowing any kernel extensions.
Reading:
Management of kernel extensions has changed significantly in Big Sur and later. This overview for users contrasts kexts with user-level extensions which are replacing them.
eclecticlight.co
developer.apple.com
System Extensions
developer.apple.com