4

I have purchased a MacBook Pro a year ago and after upgrading to Sierra started to receive notifications from a company that owned a laptop before. I have tried contacting Apple Service and the actual company, no luck so far. I have learned that I need to find two files:

/System/Library/LaunchAgents/com.apple.ManagedClientAgent.enrollagent.plist /System/Library/LaunchDaemons/com.apple.ManagedClient.enroll.plist

But I can't move them (and even create folders where they can be moved): /Library/LaunchAgentsDisabled and /Library/LaunchDaemonsDisabled

Can anyone please help how I can turn off device enrollment notifications?

2
3

Just in case you're still confused about this issue, restart your mac in recovery mode, in terminal, type in command:

csrutil disable; reboot

This will disable system integrity protection and restart your mac.

Open your terminal again, type in command:

sudo mv /System/Library/LaunchAgents/com.apple.ManagedClientAgent.enrollagent.plist /Library/LaunchAgentsDisabled
sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.enroll.plist /Library/LaunchDaemonsDisabled

This should do the trick.

However, don't for get to re-enable your system integrity protection by restarting your mac in recovery mode, typing in command:

csrutil enable

You can check your SIP status with command:

csrutil status

Good luck!

2
  • This will not work because Catalina wont allow you to change the folder. It is a read only file system.
    – derek
    May 16 '20 at 20:00
  • This worked for me on 10.13 High Sierra. In my case, I'd bought a used Mac, used it for over 3 years on 10.12 with no issue, used Linux on it, then re-installed 10.13 and all of a sudden got these messages. This solved the problem for me.
    – Woodstock
    Jan 6 at 17:22
3

On Big Sur, these solutions become problematic because disabling SSV (Signed System Volume) will prevent useful features, such as FileVault, from working.

Instead, I believe that you can prevent the ManagedClientAgent from being "helpful" by simply creating the file:

/var/db/ConfigurationProfiles/Settings/.cloudConfigProfileInstalled

e.g. disable SIP then

sudo touch /var/db/ConfigurationProfiles/Settings/.cloudConfigProfileInstalled

0
2

This works for macOS Big Sur to Disable MDM notifications

  1. Restart in Recovery Mode Restart your Mac then hold down the Command & R keys together until you're in the Recovery Mode menu (Command+R)
  2. Click on Utilities (top menu bar) then select: Startup Security Utility
  3. A 3-choices popup appears: select (No security) (there is no confirmation button to press)
  4. Restart again in Recovery Mode (Command+R)
  5. Click on Utilities (top menu bar) then select Terminal
  6. type in: mount then press enter/return
  7. A list of things will show up once you enter in (mount) in Terminal Write down the disk associated with /Volumes/Macintosh HD (mine was /dev/disk2s5) Note: it's not /, and it's not /Volumes/Macintosh HD - Data
  8. Next, in Terminal, write: umount /Volumes/Macintosh\ HD
  9. then: mkdir /Volumes/Macintosh\ HD
  10. then: mount -t apfs -rw /dev/disk2s5 /Volumes/Macintosh\ HD
  11. then: cd /Volumes/Macintosh\ HD/System/Library/LaunchAgents
  12. then: mkdir xtemp
  13. then: mv com.apple.ManagedClientAgent.* xtemp/
  14. then: mv com.apple.mdmclient.* xtemp/
  15. then: cd ../LaunchDaemons
  16. then: mkdir xtemp
  17. then: mv com.apple.ManagedClient.* xtemp/
  18. then: mv com.apple.mdmclient.* xtemp/
  19. then: csrutil authenticated-root disable (this will Turn off Signed System Volume SSV)
  20. then lastly: bless --folder /Volumes/Macintosh\ HD/System/Library/CoreServices --bootefi --create-snapshot
 (this will Save the current disk status in the boot snapshot)
  21. Now you can restart your Mac, DEP notification is disabled.
6
  • On the new M1 Mac Mini, when you go to select startup security policy, the only two choices are "Full" and "Reduced", and there is no "No security" option. Mar 26 at 15:01
  • I tried following these steps on an M1 Mini, other than selecting "no security" (because it's not an option), but instead doing "csrutil authenticated-root disable" and rebooting first as recommended in some other guides, and when I got to the last step (bless), I got "Operation not permitted." Seems like the new Apple Silicon is more resistent? Mar 26 at 19:53
  • I don't have m1 machine. But these steps definitely works for my 2019 Macbook Pro 16". Btw, every time you update macOS you need to do these steps again. Because update overrides all the changes unfortunately, which is painful. That's why I upgrade once every 3 months or so.
    – COzkurt
    Mar 27 at 22:24
  • Problem with this solution is that disables SSV which is far from ideal, and also, doesn't allow you to enable FileVault (disk encryption).
    – yorch
    Apr 6 at 17:32
  • Some of the commands did not work for me, but overall I think it did work. Remains to be seen. Step 3 did not work because FileVault is enabled. Step 19 did not work (because I had already run csrutil disable?) May 5 at 14:29
0

From your admin account, open System Preferences and click on the profiles icon. This should show you the profiles and pending profiles that you may have installed. If you can, remove any existing profiles.

If that does not resolve the problem, search the disk for any .mobileconfig files and either remove or rename their extensions. Profiles that have not yet been installed live in .mobileconfig files (often found in downloads folders).

1
  • 1
    There are no other profiles installed, but mine. Device Enrollment wants to install the profile, but no success so far. After doing the search, I wasn't able to find any files with the extension ".mobileconfig" Sep 4 '17 at 20:51
0

To Turn Off Device Enrollment on Mac:

  • Restart the Mac in Recovery Mode by holding + R during restart
  • Open Terminal in the recovery screen and type csrutil disable
  • Restart computer

Open terminal and execute the following commands:

Create directories to hold the disabled files:
$ sudo mkdir /System/Library/LaunchAgentsDisabled
$ sudo mkdir /System/Library/LaunchDaemonsDisabled

Move all prompt files into the newly created directories, effectively disabling them:
$ sudo mv /System/Library/LaunchAgents/com.apple.ManagedClientAgent.agent.plist /System/Library/LaunchAgentsDisabled
$ sudo mv /System/Library/LaunchAgents/com.apple.ManagedClientAgent.enrollagent.plist /System/Library/LaunchAgentsDisabled
$ sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.cloudconfigurationd.plist /System/Library/LaunchDaemonsDisabled
$ sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.enroll.plist /System/Library/LaunchDaemonsDisabled
$ sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.plist /System/Library/LaunchDaemonsDisabled
$ sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.startup.plist /System/Library/LaunchDaemonsDisabled

  • Restart Computer again so that the changes take effect
  • Then (re)enable SIP by restarting the Mac in Recovery Mode by holding + R during restart
  • Open Terminal in the recovery screen and type csrutil enable
  • Restart computer, no more enrollment prompts.

This Github thread helped immensely troubleshooting my own, hope it helps.

1
  • This worked for me, but I had to add one extra command in the terminal before the above command (to make my root writable): sudo mount -uw /
    – Wim
    Sep 21 at 15:03
0

I found an easy solution to get rid of the notification that worked in my case (not sure if it'll work in every case) and that didn't required to disable SIP nor go into recovery was (I'm in Big Sur v11.5):

First, block your Mac from reaching the domain iprofiles.apple.com. I use LittleSnitch as my firewall, so I blocked it there, but you can also use your hosts file like:

sudo echo "0.0.0.0 iprofiles.apple.com" >> /etc/hosts

Then, I checked the current enrollment profile

sudo profiles show -type enrollment

This will show you the current enrollment configuration your Mac has, you can even block the domain mentioned in ConfigurationURL just to be safe.

After than, I proceed to delete the profile, in my regular session, not recovery, although it would probably also work in recovery:

sudo profiles remove -all

Keep in mind that this command will delete all other profiles you may have, in my case, I didn't more.

Finally, you can check for the enrollment profile again, I would get an error saying that it could not retrieved given that I blocked the domain from where it's retrieved:

sudo profiles show -type enrollment
Error fetching Device Enrollment configuration: (34000) Error Domain=MCCloudConfigurationErrorDomain Code=34000 "The device failed to request configuration from the cloud." UserInfo={NSLocalizedDescription=The device failed to request configuration from the cloud., CloudConfigurationErrorType=CloudConfigurationFatalError}

And the notification is gone for good. I'll report back in the next OS upgrade to see if it comes back.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .