4

I recently bought a Macbook air laptop at an asset auction held by an appointed liquidating agent for a company that was going into administration with the intention of using it as my own personal computer.

The liquidating agent had advertised that they had "wiped" the hard disks prior to the sale.

Upon booting the laptop I am greeted with the OS install screen, which is fine and the install's the latest OSX with no issues however after the install is finished I am then presented with MDM Enrolment for remote management.

I've contacted the liquidating agent for help on this and they have advised that the laptop was "sold as seen" and that they don't provide IT support, the MDM enrolment seems to hang and do nothing.

Is there anyway to resolve this or have I just bought an expensive paper weight ?

Improve this question
2
  • 2
    It's a paperweight.
    – Marc Wilson
    Commented Aug 10, 2022 at 19:30
  • To be "sold as seen" you should have been given time to actually see & examine it, otherwise it's sold "as per description" … which was inaccurate/incomplete.
    – Tetsujin
    Commented Aug 11, 2022 at 7:36

3 Answers 3

Reset to default
5

This deactivation technique works, and I first tested with macOS Ventura 13.4.1. As mentioned by Ezekiel, the deactivation script must be run again after upgrading macOS, which I confirmed by upgrading to 13.6.1 (the previous unsigned snapshot was automatically purged/removed).

Deactivation

Boot into Recovery Mode from any csrutil status and run:

VOL="/Volumes/Macintosh HD"                       # Your HD name
mount -uw $VOL                                    # Enable write
cd $VOL/System/Library

# Remove service configs
mkdir -p LaunchAgents-inactive LaunchDaemons-inactive
mv -v LaunchAgents/com.apple.{ManagedClient,mdmclient}* LaunchAgents-inactive
mv -v LaunchDaemons/com.apple.{ManagedClient,mdmclient}* LaunchDaemons-inactive

bless --mount $VOL --create-snapshot --bootefi   # Create unsigned snapshot
csrutil authenticated-root disable               # Boot from unsigned snapshots
reboot

Verification

Confirm the services are disabled and show your new bootable snapshot:

sudo ls /System/Library/*-inactive
sudo launchctl list | egrep -i 'managed|mdm' || echo '✅ None active'
sudo profiles status -type enrollment
csrutil status
csrutil authenticated-root status
diskutil apfs listSnapshots /

Debugging

List services within various launchd domains (gui, user, system)

launchctl print gui/$UID  | egrep 'Managed|mdm'
launchctl print user/$UID | egrep 'Managed|mdm'
launchctl print system    | egrep 'Managed|mdm'

Show details for a specific service within its respective domain above:

launchctl print gui/$UID/com.apple.mdmclient.agent
launchctl print   system/com.apple.mdmclient.daemon
Improve this answer
3
  • 1
    Nice work! Is the machine you tested on enrolled in Automated Device Enrollment Program as well as being MDM managed with a profile that’s marked as “not user removable”? I can see how your script works well with the second category only.
    – bmike ♦
    Commented Nov 15, 2023 at 1:11
  • For DEP, I immediately intercept the "choose country" setup screen with a Recovery boot, mitigating with 0.0.0.0 in /etc/hosts.
    – anthumchris
    Commented Nov 15, 2023 at 14:50
  • That's much more elegant than needing to manage the network / router side of things which I have seen documented in the past. Thanks for addressing that as well.
    – bmike ♦
    Commented Nov 15, 2023 at 15:09
1

I am assuming that the original purchaser (the company that was liquidated / not the reseller) have registered the serial number with Apple to force MDM enrollment. The only way to reverse this is for them to have Apple de-register the serial number. This used to be called Device Enrollment Program or DEP for short and now is referred to as Automated Device Enrollment or ADE.

Improve this answer
5
  • 2
    If you have proof of purchase, you may convince Apple to do it.
    – lhf
    Commented Aug 11, 2022 at 1:20
  • No proof of purchase needed, disable MDM enrollment instead.
    – anthumchris
    Commented Nov 13, 2023 at 5:02
  • You can temporarily bypass it, but it will reactivate in the future whenever the check is re-run
    – Ezekiel
    Commented Nov 13, 2023 at 19:09
  • @anthumchris If the machine is wiped and re-setup it will fail setup again. There are also threads indicating that macOS upgrades can cause the device to re-check setup (apple.stackexchange.com/questions/297293/…)
    – Ezekiel
    Commented Nov 14, 2023 at 15:00
  • @Ezekiel - Then rephrase your comment positively towards a solutionable outcome for every user who visits this page:: "MDM can be disabled, but it may need to be disabled again after wiping/re-installing or potentially upgrading to a new version.
    – anthumchris
    Commented Nov 14, 2023 at 15:31
1

The device may have been removed from DEP but still has old configuration profiles cached.

Boot into recovery mode

Open Terminal

Delete the contents of this directory

/Volumes/Macintosh HD/var/db/ConfigurationProfiles/Store
Improve this answer
1
  • This could be viable. Would you be willing to provide command line tests for us to run A/B validations?
    – anthumchris
    Commented Nov 15, 2023 at 14:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .