Caution: Unable to reinstall macOS on 2018 MBP

[haralds]

@dwdrummwer959 i too have the same situation. I changed the secure boot mode to medium, then formatted the ssd and now im an install loop. When i boot from an installer usb or the ssd, the mac starts with the installer via internet (black screen, white globe and progress bar), and when that bar completes, it says: this os needs to be reinstalled. Just to start allover again..

Anyone who has a tip?

I did the same thing after a failed Migration made the system not bootable. I worked on this for almost 2 days including AppleCare and Genius bar, where they did not have ANY updated info. In the end I had to return it.
My efforts included successful T2 firmware restore and using target mode to clone a system.
Nothing worked. I think when you change the T2 default and erase the main partition after that you end up in an unrecoverable state. Apple support does not (yet) seem to have a utility to get you out of it.
A bit of a waste of time. It will be another 2 weeks until I get my customer order replacement.
[doublepost=1533411420][/doublepost]

I have a separate USB-C cable as described in the Apple article that I will try in the morning. I have also tried another USB-C cable (non apple) that I use with an external HD that obviously does power and data, but it might not meet Apple's expectations.

I guess I expected that if I got the key combo correct that the screen would just sit there black rather than showing Apple logo after a couple seconds after I release the key combo.

I am pretty sure the Apple USB-C cable is fully capable of data transfer.
[doublepost=1533411611][/doublepost]

In the same boat. I too am getting the install loop. Every time it says "The version of macOS on the selected disk needs to be reinstalled". I have tried for about 20 minutes straight to get the key combination right to try to restore the T2 chip with Apple Configurator. Every time, it boots to the recovery screen. I can't seem to get the keys to put it in DFU mode. I have gone over the instructions many times and I am using an Apple USB-C cable (like the charging cable) along with a 2017 MacBook Pro that is running Configurator 2 version 2.7.



I have also tried this, but no luck. Can you share any hints on how you managed to get it in DFU mode for T2 restore? Did you hold power down, then hold the others? Release all at the same time after 3 seconds, etc.?

I did select medium security and allow booting from external drive before I got in this mess.

The important things are:
- Connect the MacBook Pro target to a power supply so it will not overdraw power from the host USB.
- Depress the button combo longer than the Apple Support article indicates. IN my case it first showed the Apple and I kept the button depressed until the screen turned black. At that time the Configurator 2 showed the DFU box.

I was able to update but it did not solve my issue, which I presume to be misconfigured T2 info.
[doublepost=1533411775][/doublepost]

I have a separate USB-C cable as described in the Apple article that I will try in the morning. I have also tried another USB-C cable (non apple) that I use with an external HD that obviously does power and data, but it might not meet Apple's expectations.

I guess I expected that if I got the key combo correct that the screen would just sit there black rather than showing Apple logo after a couple seconds after I release the key combo.

You need to press it longer until the Apple disappears.

 

[sdsvtdriver]

I'm also currently stuck. Wiped drive. Won't internet boot. Keeps giving me -3403F error. Tried different internet connections with the same result.

 

[maflynn]

I'm also currently stuck. Wiped drive. Won't internet boot. Keeps giving me -3403F error. Tried different internet connections with the same result.

Call Apple?

 

[Weaselboy]

I'm also currently stuck. Wiped drive. Won't internet boot. Keeps giving me -3403F error. Tried different internet connections with the same result.

You might try using a wifi network that is open (no password). Sometimes if you are trying to use a wifi security protocol that is not supported by Internet recovery, you will get that error.

 

[sdsvtdriver]

You might try using a wifi network that is open (no password). Sometimes if you are trying to use a wifi security protocol that is not supported by Internet recovery, you will get that error.

Will try that. I’ve tried WiFi, plugged in Ethernet, and phone hotspot and they all give the error.
[doublepost=1534437797][/doublepost]

Call Apple?

Did that. They escalated and will get back to me, but basically said go to a Apple Store if urgent.

 

[KarmaRocket]

I'm not sure why Apple doesn't just add storage (or more storage) to the T2 hardware? Why not just have a basic installer with disk utility separate from the main hard drive? If you're hard drive fails for some reason (and no reliable internet access) you can at least boot it up and diagnose the problem. They don't need much space. Maybe 4GB max? I guess Apple gets charged more for storage. Probably why their storage upgrades cost an arm and a leg!

I like wiping my drives and doing clean installs when I upgrade to a new version of OS X. This method helps get rid of any gremlins I may have installed from previous work. I just backup all my necessary files and copy them back. Makes me feel like I have a new machine.

 

[haralds]

There is a security token on the partition(s) that is/are used by the System Boot Security Utility. When you wipe the disk, this is gone. Mojave release notes specifically warn you NOT to erase from Recovery.
If you have a running system, you can restore the token with:

sysadminctl interactive -secureTokenOn yournname -password

Mike Bombich of Carbon Copy Cloner describes it thusly:

Startup Security Utility - System Boot Security Utility

The Startup Security Utility may not work correctly after restoring to an encrypted-at-rest volume on T2-based Macs

The at-rest encryption described above involves a volume-specific "secure access token", which each user account must obtain access to if that user requires administrative privileges over startup security settings. Because this token is volume-specific, cloning the token from one volume to another will not produce the correct result. Additionally, user accounts that have access to the token on the source won't automatically have access to the token on a cloned volume.

Apple does not offer a method for creating this token on a volume that is not the current startup disk, so CCC cannot offer a postflight method that automatically creates that token. Apple does, however, offer a utility for creating the token on the current startup disk, and also for granting access to that token for specific users on the current startup disk. If you find that you're unable to modify settings in the Startup Security Utility while booted from the macOS Recovery volume (e.g. "No administrator was found"), reboot from your cloned volume, then paste the following into the Terminal application to create the secure access token and grant access to it to your user account (replace "yourname" with the short name of your user account):

sysadminctl interactive -secureTokenOn yournname -password

 

[BJB Productions]

Just picked up an open box 2018 Macbook Pro off eBay. I've done this many times in the past. Decided to do a wipe via recovery like I normally do, now I'm stuck with the -3403F error when trying to reinstall macOS. I've tried using a USB stick with Mojave and holding down option on startup, but no luck either.

So my understanding is the only solution is to have the Genius bar do the reinstall for me?

 

[deviant]

There is a security token on the partition(s) that is/are used by the System Boot Security Utility. When you wipe the disk, this is gone. Mojave release notes specifically warn you NOT to erase from Recovery.
If you have a running system, you can restore the token with:

sysadminctl interactive -secureTokenOn yournname -password

Mike Bombich of Carbon Copy Cloner describes it thusly:

Startup Security Utility - System Boot Security Utility

The Startup Security Utility may not work correctly after restoring to an encrypted-at-rest volume on T2-based Macs

The at-rest encryption described above involves a volume-specific "secure access token", which each user account must obtain access to if that user requires administrative privileges over startup security settings. Because this token is volume-specific, cloning the token from one volume to another will not produce the correct result. Additionally, user accounts that have access to the token on the source won't automatically have access to the token on a cloned volume.

Apple does not offer a method for creating this token on a volume that is not the current startup disk, so CCC cannot offer a postflight method that automatically creates that token. Apple does, however, offer a utility for creating the token on the current startup disk, and also for granting access to that token for specific users on the current startup disk. If you find that you're unable to modify settings in the Startup Security Utility while booted from the macOS Recovery volume (e.g. "No administrator was found"), reboot from your cloned volume, then paste the following into the Terminal application to create the secure access token and grant access to it to your user account (replace "yourname" with the short name of your user account):

sysadminctl interactive -secureTokenOn yournname -password

THANK YOU I was trying to reinstall Mojave on the Mac mini 2018 and couldnt. Good thing I had a working time machine and just a string in terminal fixed it. I wonder what’s the point of this all if it’s so easy to re create the token

 

[KarmaRocket]

Wait. Is this still a problem? I wiped my 2018 MBP from High Sierra to Mojave late last year and had no issues.

Unfortunately my work upgraded my iMac from Mojave to Catalina. I need to downgrade to Mojave as some apps run better on Mojave. Is this going to be an issue if I downgrade to Mojave by wiping the machine and reinstalling?

 

[pshifrin]

OP here. This is not an issue anymore and it was resolved by Apple a few days after my original post.