32

I have purchased a MacBook Pro a year ago and after upgrading to Sierra started to receive notifications from a company that owned a laptop before. I have tried contacting Apple Service and the actual company, no luck so far. I have learned that I need to find two files:

/System/Library/LaunchAgents/com.apple.ManagedClientAgent.enrollagent.plist /System/Library/LaunchDaemons/com.apple.ManagedClient.enroll.plist

But I can't move them (and even create folders where they can be moved): /Library/LaunchAgentsDisabled and /Library/LaunchDaemonsDisabled

Can anyone please help how I can turn off device enrollment notifications?

Improve this question
3

6 Answers 6

Reset to default
39

I found an easy solution to get rid of the notification that worked in my case and didn't require disabling SIP or going into recovery mode. It has been tested in MacBook Pro Intel (Big Sur v11.5) and in MacBook Apple M1 Pro (Ventura 13.1):

First, block your Mac from reaching the domain iprofiles.apple.com. I use LittleSnitch as my firewall, so I blocked it there, but you can also use your hosts file like:

sudo echo "0.0.0.0 iprofiles.apple.com" >> /etc/hosts

OR

Open the /etc/hosts file in your MacBook by running the command below:

sudo nano /etc/hosts

Note: It will require you to input your MacBook password since it's an admin action.

Next, add the lines below at the bottom of the file:

# Block Mac from reaching the domain iprofiles.apple.com
0.0.0.0 iprofiles.apple.com

Save the file.

Then, check the current enrollment profile:

sudo profiles show -type enrollment

This will show you the current enrollment configuration your Mac has, you can even block the domain mentioned in ConfigurationURL just to be safe. It might also return the error below:

Error fetching Device Enrollment configuration: (34000) Error Domain=MCCloudConfigurationErrorDomain Code=34000 "The device failed to request configuration from the cloud." UserInfo={NSLocalizedDescription=The device failed to request configuration from the cloud., CloudConfigurationErrorType=CloudConfigurationFatalError}

After that, proceed to delete the profile, in regular session, not recovery, although it would probably also work in recovery:

sudo profiles remove -all

Keep in mind that this command will delete all other profiles you may have, in my case, I didn't have any other.

Finally, you can check for the enrollment profile again. It would throw an error saying that it could not be retrieved given that the domain from it's retrieved is now blocked:

sudo profiles show -type enrollment
Error fetching Device Enrollment configuration: (34000) Error Domain=MCCloudConfigurationErrorDomain Code=34000 "The device failed to request configuration from the cloud." UserInfo={NSLocalizedDescription=The device failed to request configuration from the cloud., CloudConfigurationErrorType=CloudConfigurationFatalError}

And the notification is gone for good. I'll report back in the next OS upgrade to see if it comes back.

Improve this answer
11
  • 2
    Can confirm that calling sudo profiles show -type enrollment triggers the notification and that blocking it via /etc/hosts and running the command afterwards fails. I'll report as well if I receive the notification again or the next OS upgrade does something with it.
    – Alec Gerona
    Commented Oct 7, 2021 at 3:35
  • 2
    Elegant solution that works without modifying the signed System, thank you! I used /etc/hosts and it seems to work. I did have trouble with "sudo echo" and used "sudo -e" to edit in Vim instead.
    – Vanessa Phipps
    Commented Oct 10, 2021 at 22:01
  • Worked for me, when nothing else did!
    – EigenTheory
    Commented Oct 22, 2021 at 22:38
  • 1
    "sudo profiles remove -all" worked for me on Mac OS 12.4 Monterey but only after I also blocked the ConfigurationURL in my hosts file. Thank you!
    – Feanne
    Commented May 23, 2022 at 5:57
  • Thanks. This worked for me. I added more context though to the answer from my experience.
    – Promise Preston
    Commented Jan 28, 2023 at 16:25
5

On Big Sur, these solutions become problematic because disabling SSV (Signed System Volume) will prevent useful features, such as FileVault, from working.

Instead, I believe that you can prevent the ManagedClientAgent from being "helpful" by simply creating the file:

/var/db/ConfigurationProfiles/Settings/.cloudConfigProfileInstalled

e.g. disable SIP then

sudo touch /var/db/ConfigurationProfiles/Settings/.cloudConfigProfileInstalled

Improve this answer
0
4

Just in case you're still confused about this issue, restart your mac in recovery mode, in terminal, type in command:

csrutil disable; reboot

This will disable system integrity protection and restart your mac.

Open your terminal again, type in command:

sudo mv /System/Library/LaunchAgents/com.apple.ManagedClientAgent.enrollagent.plist /Library/LaunchAgentsDisabled
sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.enroll.plist /Library/LaunchDaemonsDisabled

This should do the trick.

However, don't for get to re-enable your system integrity protection by restarting your mac in recovery mode, typing in command:

csrutil enable

You can check your SIP status with command:

csrutil status

Good luck!

Improve this answer
3
  • This will not work because Catalina wont allow you to change the folder. It is a read only file system.
    – derek
    Commented May 16, 2020 at 20:00
  • This worked for me on 10.13 High Sierra. In my case, I'd bought a used Mac, used it for over 3 years on 10.12 with no issue, used Linux on it, then re-installed 10.13 and all of a sudden got these messages. This solved the problem for me.
    – Woodstock
    Commented Jan 6, 2021 at 17:22
  • 1
    This does not work on Big Sur.
    – EigenTheory
    Commented Oct 22, 2021 at 22:39
3

This works for macOS Big Sur to Disable MDM notifications

  1. Restart in Recovery Mode Restart your Mac then hold down the Command & R keys together until you're in the Recovery Mode menu (Command+R)
  2. Click on Utilities (top menu bar) then select: Startup Security Utility
  3. A 3-choices popup appears: select (No security) (there is no confirmation button to press)
  4. Restart again in Recovery Mode (Command+R)
  5. Click on Utilities (top menu bar) then select Terminal
  6. type in: mount then press enter/return
  7. A list of things will show up once you enter in (mount) in Terminal Write down the disk associated with /Volumes/Macintosh HD (mine was /dev/disk2s5) Note: it's not /, and it's not /Volumes/Macintosh HD - Data
  8. Next, in Terminal, write: umount /Volumes/Macintosh\ HD
  9. then: mkdir /Volumes/Macintosh\ HD
  10. then: mount -t apfs -rw /dev/disk2s5 /Volumes/Macintosh\ HD
  11. then: cd /Volumes/Macintosh\ HD/System/Library/LaunchAgents
  12. then: mkdir xtemp
  13. then: mv com.apple.ManagedClientAgent.* xtemp/
  14. then: mv com.apple.mdmclient.* xtemp/
  15. then: cd ../LaunchDaemons
  16. then: mkdir xtemp
  17. then: mv com.apple.ManagedClient.* xtemp/
  18. then: mv com.apple.mdmclient.* xtemp/
  19. then: csrutil authenticated-root disable (this will Turn off Signed System Volume SSV)
  20. then lastly: bless --folder /Volumes/Macintosh\ HD/System/Library/CoreServices --bootefi --create-snapshot
 (this will Save the current disk status in the boot snapshot)
  21. Now you can restart your Mac, DEP notification is disabled.
Improve this answer
6
  • On the new M1 Mac Mini, when you go to select startup security policy, the only two choices are "Full" and "Reduced", and there is no "No security" option.
    – Brian Goetz
    Commented Mar 26, 2021 at 15:01
  • I tried following these steps on an M1 Mini, other than selecting "no security" (because it's not an option), but instead doing "csrutil authenticated-root disable" and rebooting first as recommended in some other guides, and when I got to the last step (bless), I got "Operation not permitted." Seems like the new Apple Silicon is more resistent?
    – Brian Goetz
    Commented Mar 26, 2021 at 19:53
  • I don't have m1 machine. But these steps definitely works for my 2019 Macbook Pro 16". Btw, every time you update macOS you need to do these steps again. Because update overrides all the changes unfortunately, which is painful. That's why I upgrade once every 3 months or so.
    – COzkurt
    Commented Mar 27, 2021 at 22:24
  • Problem with this solution is that disables SSV which is far from ideal, and also, doesn't allow you to enable FileVault (disk encryption).
    – yorch
    Commented Apr 6, 2021 at 17:32
  • Some of the commands did not work for me, but overall I think it did work. Remains to be seen. Step 3 did not work because FileVault is enabled. Step 19 did not work (because I had already run csrutil disable?)
    – Rahman
    Commented May 5, 2021 at 14:29
2

To Turn Off Device Enrollment on Mac:

  • Restart the Mac in Recovery Mode by holding ⌘ + R during restart
  • Open Terminal in the recovery screen and type csrutil disable
  • Restart computer

Open terminal and execute the following commands:

Create directories to hold the disabled files:
$ sudo mkdir /System/Library/LaunchAgentsDisabled
$ sudo mkdir /System/Library/LaunchDaemonsDisabled

Move all prompt files into the newly created directories, effectively disabling them:
$ sudo mv /System/Library/LaunchAgents/com.apple.ManagedClientAgent.agent.plist /System/Library/LaunchAgentsDisabled
$ sudo mv /System/Library/LaunchAgents/com.apple.ManagedClientAgent.enrollagent.plist /System/Library/LaunchAgentsDisabled
$ sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.cloudconfigurationd.plist /System/Library/LaunchDaemonsDisabled
$ sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.enroll.plist /System/Library/LaunchDaemonsDisabled
$ sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.plist /System/Library/LaunchDaemonsDisabled
$ sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.startup.plist /System/Library/LaunchDaemonsDisabled

  • Restart Computer again so that the changes take effect
  • Then (re)enable SIP by restarting the Mac in Recovery Mode by holding ⌘ + R during restart
  • Open Terminal in the recovery screen and type csrutil enable
  • Restart computer, no more enrollment prompts.

This Github thread helped immensely troubleshooting my own, hope it helps.

Improve this answer
1
  • This worked for me, but I had to add one extra command in the terminal before the above command (to make my root writable): sudo mount -uw /
    – Wim
    Commented Sep 21, 2021 at 15:03
0

From your admin account, open System Preferences and click on the profiles icon. This should show you the profiles and pending profiles that you may have installed. If you can, remove any existing profiles.

If that does not resolve the problem, search the disk for any .mobileconfig files and either remove or rename their extensions. Profiles that have not yet been installed live in .mobileconfig files (often found in downloads folders).

Improve this answer
1
  • 1
    There are no other profiles installed, but mine. Device Enrollment wants to install the profile, but no success so far. After doing the search, I wasn't able to find any files with the extension ".mobileconfig"
    – vgrinchenko
    Commented Sep 4, 2017 at 20:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .