28

I got a 2015 MacBook Pro from eBay. I’m trying to install Sierra from scratch (after completely formatting the SSD) but I get this strange extra step (although the install USB is vanilla and done using Apple’s own bootable usb tool) that I can’t pass (pressing continue asks me to connect to a IBM private network, which I obviously can’t do)

Does anyone have any info about this. Where is this MacBook comming from? How can I disable this remote management step? Is this a custom firmwere, or where does this come from?

macOS installer

7
  • 5
    This laptop may be stolen property. To protect yourself, contact your local police station, constabulary, etc, as well as eBay, and report the serial number. – IconDaemon Jan 3 '18 at 18:26
  • 7
    @IconDaemon I'm starting to worry that's the case. What other legit reason could there be for a 2 and a half years old enrolment Macbook sold privately outside the company? I'll contact Apple Customer Support tomorrow to see if it was flagged. Also thinking of writing IBM as well, maybe they have a database of stolen hardware ids. What can I say, I just hope I won't lose both the laptop and the cash :( – Valentin Radu Jan 3 '18 at 19:20
  • 4
    Please come back after your dealings are done, we all are interested in the result! – Kyslik Jan 3 '18 at 21:51
  • @Kyslik So far so good, I've contacted Apple and it doesn't figure as stolen also contacted local police and again it's clear. Unfortunately, this doesn't make me feel at ease. Apple doesn't really have a flagged(stolen) devices register so if you turn off Find my Mac you're out of luck. As for police, really, this could have been stolen in another country or even another continent. Will contact IBM later on today, but I expect it will take a while to dig through their corporate layers. Also, big red flag is that the seller told me he got it form a friend, so, no proof of purchase :( – Valentin Radu Jan 4 '18 at 8:02
  • 2
    Any update? Facing the same problem here and can't get the "owning" company to even talk to me about it. – Jeff Evans Aug 3 '18 at 20:26
21

This Mac has been enrolled under Device Enrollment. Upon connecting to Apple, the device has received instructions to be managed by IBM.

This cannot be bypassed. You should contact the seller.

Mobile Device Management ‘locks’ enforced by Device Enrollment are enforced by Apple’s severs and are based on hardware identification, so cannot be removed by macOS reinstallation ― they’re defined to be enforced as soon as the Mac is unboxed for the very first time prior to any manual configuration.

About Device Enrollment

5
  • 2
    What would happen if the mac was offline during the first setup process? – Alexander Jan 4 '18 at 1:42
  • @Alexander with no internet access during the installer, it might proceed but phone home at the first chance, or it might not allow the installer to complete at all. – Criggie Jan 4 '18 at 1:46
  • 4
    Ok, did some research. The way things are now, you can install the OS if you're not connected to the internet and will not be bother again later (even if you'd like to). It seems it's a flaw in Apple's system many enterprises are complaining about. This could be fixed in the future. Also, if the purchase is ligit (confirmed by initial owner), Apple can help with removing the Mac from the enrolment program. – Valentin Radu Jan 4 '18 at 8:11
  • 1
    I was able to bypass this on my 2018 Mac Book Pro. I installed the OS using an internet connection. When I got to the "remote management" screen, I restarted. When it asked me to choose my network, I selected "other options" and selected "no internet". I was then able to complete the setup and connect to the internet normally afterward. I did a hard reboot and am still able to login and connect to the internet fine. – Ben Oct 28 '20 at 18:37
  • I was able to bypass this check by NOT selecting a network while setting up the big sur os. Here's what I did: 1)erased the Mac HD 2)rebooted with option+command+R 3)installed the Big Sur OS using WiFi 4)on the first Big Sur set up screen I did NOT activate the WiFi and I did the whole wizard offline 5)once logged in I turned on the WiFi – Marco C. Feb 8 at 14:27
10

This process worked to get a 2018 mac from eBay working with fresh install Catalina. It used a USB for fresh install but the process may also work with a recovery mode configuration on a mac that is running already. Either way, the main disable happen from recovery mode.

Reformat and install from 16GB USB stick

  1. Download Catalina from Apple Store to a working Mac
  2. Create USB boot stick with free program DiskMaker X
  3. Eject stick and reboot mac
  4. Press Option Key as soon as u see the Mac apple
  5. Choose to boot from USB Key - On this attempt, there was a message stating "A software update required to use this startup disk". Apparently the installer needs to peek at Mac server to see if it knows the Mac is enrolled in a management scheme and update, or it may be confused by mac T2 chip. It failed until the internet connection was established. With a wifi or ethernet connection it went through the installer update and was happy. Booted again to USB and continued like usual.
  6. Open Disk Utility
  7. Locate computer hard drive and choose Erase
  8. Close disk utility
  9. Do Install new Mac OS from USB
  10. When it tries to setup, don't do anything. Just shut down and reboot again to recovery mode using Command + R keys just when u see the Mac apple.

No reformat. Start here if u did not install a fresh

  1. Reboot mac and use Command + R key to enter recovery mode.

Disable Daemon, Agent and Phone home

  1. In recovery tools choose Terminal from the Utilities menu
  2. Do following command csrutil disable
  3. Reboot and go again to recovery mode with Command + R key.
  4. Use Disk utility to mount main Mac disk, if it is not mounted.
  5. Close Disk utility
  6. Choose Terminal from the Utilities menu
  7. Type carefully the following commands in Terminal to prevent the MDM robots starting up

    cd /Volumes/Macintosh\ HD/System/Library

    mkdir LaunchDaemons.disabled LaunchAgents.disabled

    mv LaunchDaemons/com.apple.ManagedClient* LaunchDaemons.disabled/

    mv LaunchAgents/com.apple.ManagedClient* LaunchAgents.disabled/

  8. Type carefully the next commands to send inquiries to blackhole

    cd ../../etc

    echo "0.0.0.0 iprofiles.apple.com" >> hosts

    echo "0.0.0.0 mdmenrollment.apple.com" >> hosts

    echo "0.0.0.0 deviceenrollment.apple.com" >> hosts

    echo "0.0.0.0 gdmf.apple.com" >> hosts

  9. Last enable System Integrity Protection

    csrutil enable

  10. Reboot the mac

Skip internet on first go

As going through setup, when prompted to establish a internet connection do not allow the connection. Skip it until you can click "Continue without an internet connection" and complete setting up the admin account and other features as prefered.

When all done and in the admin account it was possible to connect internet and have been rebooting it numerus times now and did not get the enrollment prompt again.

4
  • 2
    This is working for me. – Juan García May 24 '20 at 9:58
  • > "the process may also work with a recovery mode configuration on a mac that is running already" apparently needs to be a fresh install. guess this gets cached somewhere, so if you accidentally make it to the step where you see "remote management" then you'll have to erase and start over. If you continue you'll get an error from management tool instead of this getting skipped altogether. – rrosa Sep 20 '20 at 21:13
  • Has anyone found a way to clear the settings? or Do I have to do a fresh install as mentioned by @rrosa? – Tamil Dec 12 '20 at 5:53
  • This works perfectly. Did a clean install with Mojave. The important thing that's easy to miss is, when doing a clean install, make sure to choose No Internet from the network options. Otherwise it will force you to authenticate. – mastaBlasta Dec 19 '20 at 18:33
3

I believe that there's an easier way, one that does incorporate some of the steps above. Here's what worked for me:

Editing the hosts file appears to have worked all by itself. There's no need to reboot into Recovery Mode, disable SIP or FileVault, or move/disable the plists controlling the daemons related to device enrollment and management. You can edit the hosts file in Terminal while logged in normally, although not using those "echo" commands (even typing 'sudo echo "0.0.0.0 albert.apple.com" >> hosts' gave the error 'permission denied: hosts'). I googled editing the hosts file, and the trick appears to be to use the nano editor:

  1. Type in terminal: sudo nano /private/etc/hosts. Enter admin password when prompted.

  2. Use Arrow key on your keyboard to move the cursor to the last line and type the following lines:

    0.0.0.0 iprofiles.apple.com
    0.0.0.0 mdmenrollment.apple.com
    0.0.0.0 deviceenrollment.apple.com

  3. Press Control + X from keyboard to Exit.

  4. Now you will be asked to asked whether you want to save and to enter Y for yes and N for No. Type Y [be sure to do this!]

  5. Check to see whether the enrollment calls are being blocked by typing 'sudo profiles show -type enrollment'

You should see an error like this:

(34000) Error Domain=MCCloudConfigurationErrorDomain Code=34000 "The device failed to request configuration from the cloud." UserInfo={NSLocalizedDescription=The device failed to request configuration from the cloud., CloudConfigurationErrorType=CloudConfigurationFatalError}

That should be all there is to it! Many thanks to all those on gist.github.com who proposed various solutions.

4
  • I have a device configured with DEP that I'm looking to bypass. I have obtained the device through legal means. I booted into recovery mode after wiping the harddrive and I'm working on reinstalling Big Sur without DEP / remote management enabled. I followed these directions but nano wasn't available in the terminal so I had to use vim which was annoying but not insurmountable. I received an error Unable to reach server when attempting the Big Sur reinstall the first time. I tried again and the install went through. I'm now at the first reboot and installing still. Will update. – anon58192932 Dec 19 '20 at 17:37
  • You should follow these directions after installing Big Sur -- after you reach the setup screen for DEP, you turn off internet access and choose the option for "no internet access." Once you're at the desktop, then you modify the host file. – odysseus Dec 19 '20 at 21:52
  • Every reinstall of big sur I tried didn't work - DEP activated each time and Big Sur required an internet connection to begin installing at all. What did work was wiping out every partition and entered some kind of safe recovery called internet recovery. Once there it forced a base catalina image to be installed. Once at that screen I used the hosts block entries to bypass DEP and catalina had no issue installing without internet. Once logged it I triple checked the hosts file and then upgraded to big sur. Viola! No DEP and updated to big sur. – anon58192932 Dec 20 '20 at 4:45
  • 1
    Thanks for pointing this out. I have an M1 Mac and started with a DFU restore which requires another Mac and Configurator 2. – odysseus Dec 20 '20 at 11:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .