2

Is it possible to do either of the following:

  1. Remove Air Watch from an iOS device without deleting WiFi/Exchange profiles
  2. Backup the profile and restore it after removing Air Watch?
2
  • 1
    Sorry for the long answer of "no" but I wanted to make something that's graspable by lots of people. If you need some specific details, ask a follow on question and I'll gladly lend an eye and see if I can help with a follow on question if needed.
    – bmike
    Commented Dec 1, 2015 at 15:07
  • 1
    Long answers of 'no' are always more welcome than 'no, because it isn't' :) I'll have a read when I'm home from work
    – Jon Story
    Commented Dec 1, 2015 at 16:18

1 Answer 1

2
+100

Apple signs the profiles cryptographically so this would most likely require a jailbreak to even attempt modifying the OS code that handles chaining MDM enrollment with MDM granted Apps, profiles, shared secrets, and MDM delivered trust certificates.

Unless there is an exploitable bug in either the MDM (AirWatch in this case) or iOS, you won't be able to accomplish either of your goals. Apple restricts the MDM technical documentation to enterprise level developers and to selected partners - even paid developers cannot generally see the details of the implementation, so I can't link to an official Apple page listing how this works.

Now - here's what you can to to learn more about the certificates and the profile you (the end user) can control:

  • Open the Settings app
  • Tap General
  • Scroll to below Date & Time and tap Device Management
  • Tap your MDM Enrollment profile (and yes, this is just a file that gets emailed to you or downloaded from a web page, so you could probably download it with a computer to inspect it if your MDM endpoint is publicly available)

You should be able to see who has signed the profile and whether your device trusts / can verify the cryptographic chain used to sign that certificate for the date/time your device reports. These profiles generally have a start and end time bracket that automatically invalidates the profile except for a window of time.

The system is designed to keep you from changing anything in the file - and you can either opt in to keeping the restrictions or Remove Management which removes everything that depends on this profile in a cryptographic/mathematical sense.

Now for the good news, you can try this management for free with one MDM solution I'm familiar with: http://www.bushel.com

You'll also want to watch some introductory presentations about certificates. I'd recommend the "Let's Talk about Certificates" by Ben Toms (a.k.a. mac mule)

Warning, the last link contains humor since there are a lot of acronyms and technical jargon to be cut through that dryness with some levity. Skip to 2:30 to learn about trust and identification and whether you want to watch the entire presentation or not. And, what you ask would be like Apple and AirWatch being crew there to catch the woman in her "trust" fall.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .