Mac Studio M4 login hangs after overnight sleep on macOS 27

Agree with @Owl-53's assessment. The most likely culprits are Infocyte which crashed 14 times in two days time. That is a lot of crashes.

The Datto software is also a likely culprit. It is an unsigned app plus doesn't clean up after itself very well. It has a lot of ties into the OS. These types of apps tend to cause the most stability & performance issues. Software used specifically in EDU environments tend to be problematic anyway. I see the Infocyte is actually part of the Datta software (or related).

Try booting into Safe Mode at the end of the day to see if you still have the same issue when trying to log into the system the next day.

If you don't have the issue with Safe Mode, then the Datta/Infocyte software is likely the source of the problem. You will need to uninstall them by following their developer's instructions. Run another EtreCheck report afterwards to confirm all parts of that software have been removed. If this software is required by IT, then you will need to work with them to resolve the issue.

You do have a couple other apps installed which I'm not familiar. They could also be suspect, but I'm not a macOS software expert. I find unusual tends to be a good place to look though.

You can also try running Disk Utility First Aid on the hidden Container. Even if the First Aid summary says everything is "Ok", click "Show Details" and scroll through the report to see if any errors or warnings are shown. If there are, then run First Aid again until they are gone. If after several scans the errors/warnings remain, then they cannot be repaired. Where those errors/warnings are located can decide how to resolve them. Some can be ignored, while others will require erasing the system (how the system is erased also depends on where the errors/warnings are located as there are two different methods). See the following Apple article for details on how to run First Aid on the hidden Container:

How to repair a Mac storage device with Disk Utility - Apple Support

Thank you all. I also read that sometimes the Datto/Infocyte HUNTAgent, causes a breakdown during verification, where the system is waiting for local authentication daemons or network security agents to wake up and respond. But because those agents are stuck or failing to communicate properly with the newly updated authentication systems in macOS 27, the login manager spins forever waiting for a green light that never arrives. It did work fine in OS 26, so assume it's the upgrade to 27 hasn't been updated in Datto.

I switched off wifi and pulled the ethernet cable overnight, which worked (at least these past couple of days) - so it didn't hang while waiting for the authorisation. I'll check with deleting Defender (I do also have a personal M365 account, so it could have installed when popping on the Office suite. 🫣. I was surprised at the crashing as the Mac works so much better than any Windows machine I've used. I admit, I am a 'user' and as long as something works, I'm happy!

So:

1. Remove Defender
2. Check with IT if they have an update or help with removal of Datto (business not a university)
3. Re-run Etrecheck
4. Unplug network access so no need to force reboot in between

Thanks; and yes - I'm kind of at that point. As it turned out, Defender hadn't been installed - just the download for it (easily binned). The killing network traffic was just to try and isolate a possible cause - and I'd gone through so many dead-ends, happy. to try anything! Before the update to OS, everything just worked as you'd imagine any Mac to.

My machine has now been moved into a Test company environment which will disable the Datto EDR policies. I can't test anything as during the day there is never any issue (hence the thought it's some kind of handshake between datto that's getting stuck.

And, I've made the rod for my own back. I like to use the Mac, as (usually) it would run rings around my work's Windows laptop - so I'm the only one in the company that's doing this BYOD idea. If it doesn't work, it's back to my using the work laptop all day every day. 😟 Equally, I don't want to be the one that's machine was compromised because it hadn't been enrolled in the company's Intune/whatever setup.

Having identified the issue (and now found there is a Datto issue - "because macOS 27 natively eliminated support for standard Rosetta 2 translation during certain background boot actions, the older version of the Datto RMM and EDR/AV background services fail silently or deadlock". 

What I recommend next

1. Check with your university’s IT department to determine whether your Mac is enrolled in device management or has university-required security software. Ask whether the Datto/AEM and Infocyte agents in your report are expected.
2. Don't remove those agents manually yet. If they're university-managed, removing them could disrupt required services or violate university policy. If they're remnants of older software, IT can help establish the appropriate removal procedure.
3. Run one controlled overnight test. Disconnect nonessential USB hubs, external SSDs, and adapters, leaving only the monitor, keyboard, and essential connections. If possible, pause OneDrive syncing before the test. This helps narrow down whether connected devices or background activity contribute to the problem.

I would still avoid erasing the Mac for now. Your report indicates that the internal SSD is healthy, and there are several less disruptive avenues to investigate first.

One key question: Does your university require you to install a management or security profile on this Mac, or is it simply associated with your university account (for example, your university email or Microsoft 365 account)?

Joescamera wrote:

Thank you. To add; Datto av is installed as part of our IT security, so may not be as dodgy as it looks. It is my machine, which I prefer to use for work, so a compromise was made. 🤞

I have some other concerns regarding some of what Etrecheck's report shows.

(1) Lots of blocked apps in the Firewall, including a slew of Apple processes such as

com.apple.identityservicesd

com.apple.cmio.ContinuityCaptureAgent

com.apple.universalcontrol

com.apple.NetAuthSysAgent

com.apple.Safari

and some of these sound related to login or authentication. Which is where you are having problems. I expect some or all of this was set up by your employer.

I share the concern previously voiced about the datto/infocyte security package having so many unsigned files. This is not guaranteed to be a problem but it speaks to possibly incompatibility with Macs in some environments, or at least not following Apple best practices.

Also, Firewall blocked apps include:

UBF8T346G9.com.microsoft.OneDrive

 com.microsoft.OneDrive.FileProvider

yet Microsoft One Drive is installed and its updaters and its SyncReporter are running in the background and OneDrive Launcher is in the LoginItems. In fact OneDrive Sync Service is one of the "top cpu and memory processes" found.

Also, Microsoft_Defender is installed. Datto warns not to do that:

When installing Datto AV on Windows workstations, Windows Defender will be disabled automatically. When installing Datto AV on Windows Server, Windows Defender should be uninstalled automatically. If the Datto AV agent is not able to uninstall Windows Defender, you will need to do so manually, as explained in article Removing Windows Defender when installing Datto AV.

Prior to installing Datto AV on a Mac, users will need to uninstall the other AVs to avoid conflicts.

I believe that there are elements in the way this Mac is being "Managed" through the profile that are inconsistent and can conflict with the macOS, or just some of those elements are self conflicting. I have used a managed Mac at work for over two decades and the bottom line is that it is incumbent on the Manager of the Configuration Profile (in this case, your employer?) to fully test the set up and ensure it runs conflict free. My employer did this, not perfectly, but was very proactive to identify and fix these issues, or respond when users reported them. Not being able to log in after long sleep is a pretty basic flaw and I am surprised something this blatant is being allowed to persist. Forcing a hard reboot each day will put both your personal data and your employer's data at risk. That is completely unacceptable. Because of the complexity of your company's configuration of this Mac, it may be very hard for you to troubleshoot because you don't have access to all the information needed. Also you mentioned some compromises between you and the employer on what was active -- that may have taken your Mac into a different regime than the one your employer is familiar with and has tested for.

You may not want to hear this, but I think you would be much better off having a separate Mac for work things, and a separate Mac for personal things. Eventually I did this for both my Mac and iPhone, so I had two Macs and two iPhones, one for work and one for personal. Once you do this, your life becomes so much simpler and more stress free.

Back on Microsoft_Defender:

I can't say one way or another whether this security program and anti-virus app might be contributing to your login hang, but it's suspicious because these are functions normally handled by the macOS, and usually one recommends against third party tools for this because they seem to interfere with the regular Mac functions. Tthe user login is the most basic Mac security function and your Mac has this third party security/anti-virus tool there. Maybe no connection there, but I would never use it.

Even if you know not to install them, one has to be vigilant. I was setting up a new M5 Macbook Air today for my wife to use and was installing Microsoft 365, as we have a family subscription. She uses Word a lot and sometimes Excel, and refuses to change to something like Pages or Numbers. Anyway, the default Microsoft 365 installation proceeds to install other things as well, without really informing the user. Such as Microsoft Teams, which I am ok with, but also ... Microsoft Defender! Horrified to discover this, I quickly found how to uninstall it.

I recall once my employer's managed Macs (these work computers were all on an enterprise managed Mac and PC program, including mine, there was no choice or opt out option) were pushed out a flawed anti-virus update overnight and guess what, none of the thousands of Mac users could log on the next morning. This was during the pandemic when working from home was mandated. The solution was published in a Slack support channel which we could read on our iPhones (our Macs were of course not usable when this happened). The instructions were to boot into Recovery and carefully remove the flawed anti-virus update files by using a series of Terminal commands that were in the Slack message.

Like HWTech, I would never (knowingly) install things like that on our personal Macs.

Part 1 of 2

Restart the computer in Safe Mode 

Do the issues persist ?

Sometimes a Safe Boot followed by a Normal Boot will just put things right.

If not - there could be something in the main User Account playing up.

To further isolate this - Set up users, guests, and groups on Mac.

Then log out of the Main User account and log into the dummy account and test again if the issue persists.

If the issue is present in the dummy account - then, this appears to be a System Wide issue on the computer.

Part 2 of 2

To Drill Down further and to avoid a game of 20 questions  

Download the Application Etrecheck  ( External Link ) directly from the Developer.

The Application is Not a " Silver Bullet "  and is  only a tool to examine the Hardware / Software used on this computer 

This is a Diagnostic Tool that makes no changes to the computer Hardware / Software used on this computer 

The application is free or paid from added features. 

The Report will Not Reveal Any Personal Information. 

Post back the Full Report - Share Report >> Copy , then  paste  >>>> using the Additional Text Icon  <<<<

Joescamera wrote:

I switched off wifi and pulled the ethernet cable overnight, which worked (at least these past couple of days) - so it didn't hang while waiting for the authorisation.

That's CRAZY -- should never have to do that. It's also fragile, what if this starts happening with any reboot, then how do you handle a macOS update which has many reboots. Or what if you update your Mac's OS overnight and it then sleeps but then you can't log in next morning without disconnecting from the internet but you might need that internet to be active to finish the installation ... or ... who knows what other things are broken by this. I admire your cleverness in getting around this but I could never put up with this situation. I realize you may not have much choice in the matter.

I was surprised at the crashing as the Mac works so much better than any Windows machine I've used. I admit, I am a 'user' and as long as something works, I'm happy!

I have a good comparison between my "Managed Mac" used only for work (provided by employer) which is saddled with anti-virus, BigFix, and all kinds of remote monitoring, scanning and in some cases active control. Then I have the same Mac model, same macOS, my personal Mac, used by me for my own personal things, with none of that extra intrusive stuff installed. The home Mac never crashes or freezes, nor has had any issues, it often runs for weeks or months without me shutting it down or rebooting. Time Machine works like a swiss clock, takes seconds for updates. Then there is the work Mac, which is also pretty good, but once in a week or two will have some issue, maybe web pages that don't respond, requiring power to be cycled; also its Time Machine backup updates can take many minutes or even hours, which I attribute to the anti-virus inspecting everything passing to/from the Mac. The work Mac also has a mandatory employer VPN for off-lab use which prevents use of printers when on the home network, and that VPN also slows the internet down by x2-x3. Looking on the Slack channel used for IT problem reporting, for the PCs it's all over the place, many issues of all sorts are reported continuously; for the Macs, maybe 95% of the anomaly reports have to do with the anti-virus and VPN, which makes me almost consider them to be a form of malware. 😱

So:

Remove Defender

Not hard, first put it in the trash and empty trash. That's what I did, I do plan to search the Mac with FindAnyFile to make sure remaining pieces are not there. Microsoft also has uninstallers but they did not look right to me.

Unplug network access so no need to force reboot in between

I guess a person does what they have to do, but in 2026, this band aid strikes me as nuts. And disconnecting from WiFi (and internet) overnight seems not good because that prevents updates, syncs and critical notifications that might be good to get. Instead of doing that, why not just shut down the Mac (power off) overnight until this is resolved, don't bother letting it sleep. Or leave it on but don't allow sleep, you can do that while still requiring a login password to get past the screensaver.

Thanks for the update. I recall that Defender was listed as installed, but I don't recall seeing Defender actually running, however, there were a lot of things in the report so I may have missed it.

FYI, it can take third party developers a while to update their software to work with a new major OS release (26.x to 27). This is one reason I caution users to wait at least several months before upgrading, or checking that each third party app is fully compatible with the new OS prior to upgrading. Some third party developers may take even longer than three months to update their apps. Even with minor OS update patches (26.1 to 26.2) can break third party software and it could be a days or a week for a third party developer to release an update.

Please keep us updated on your progress. It will help us to help others, plus it can help other users reading your post...both in understanding the problem and the process required to investigate & resolve it. Your posts here have been well written and understandable with good details which makes it a great thread for others to view.

Thank you. Yes; I tried Safe Mode, but the issue is only when logging back in overnight. Genuinely can't remember if I left Safe Mode on for that long, so may try again over a period of days. And I'm currently using a secondary account, which initially worked - for one day - but reverted back to the frozen login at first attempt from overnight. I don't know too much about Mac's, but don't like the look of the two Major Issues it found. 😕

steve626 wrote:

You may not want to hear this, but I think you would be much better off having a separate Mac for work things, and a separate Mac for personal things. Eventually I did this for both my Mac and iPhone, so I had two Macs and two iPhones, one for work and one for personal. Once you do this, your life becomes so much simpler and more stress free.

I highly agree..

If an employer is being investigated or has some other legal troubles, then a dual use laptop can be seized and analyzed which means both work & personal data will be copied & analyzed by the investigators.

And I would never install anything like these apps on my own personal device. I would only do so on a dedicated work device (even if it was my own private device) if an employer does not provide a device to the employee (more likely for outside contractors).

Thank you for the Etrecheck Report 👍

We will get back to you with the findings

Thank you. To add; Datto av is installed as part of our IT security, so may not be as dodgy as it looks. It is my machine, which I prefer to use for work, so a compromise was made. 🤞

Thank you. I'd "Upvote" you but apparently I've reached my limit for today. 🤷‍♂️