0

A strange problem occurred after I clean-installed Big Sur on my company's 2019 MacBook Pro. My machine now asks for incorrect device enrollment credentials (this is not my company!): enter image description here

Before the clean install, my machine was registered to the correct MDM profile and I could log in using my standard company credentials.

I checked what profiles are installed, and get back null:

brutal_blondie~$ sudo -u rennedev profiles -L
There are no configuration profiles installed for user 'rennedev'

However, when I check what enrollment profiles are installed, I get this (organization information redacted for their privacy):

brutal_blondie~$ sudo profiles show -type enrollment
Password:
Device Enrollment configuration:
{
    AllowPairing = 0;
    AutoAdvanceSetup = 0;
    AwaitDeviceConfigured = 0;
    ConfigurationURL = "XXXXX";
    IsMDMUnremovable = 1;
    IsMandatory = 1;
    IsMultiUser = 0;
    IsSupervised = 1;
    MDMProtocolVersion = 1;
    OrganizationAddress = "XXXXX";
    OrganizationAddressLine1 = "XXXXX";
    OrganizationCity = XXXXX;
    OrganizationCountry = USA;
    OrganizationDepartment = "XXXXX Baptist Church";
    OrganizationEmail = "[email protected]";
    OrganizationName = "XXXXX Baptist Church";
    OrganizationPhone = XXXXX;
    OrganizationSupportPhone = XXXXX;
    OrganizationZipCode = "XXXXX";
    SkipSetup =     (
        Registration,
        FileVault,
        iCloudDiagnostics,
        iCloudStorage,
        Appearance,
        Location,
        Restore,
        AppleID,
        TOS,
        Biometric,
        Payment,
        Siri,
        Diagnostics,
        DisplayTone,
        Privacy,
        ScreenTime
    );
}

Does anyone know how this happened and what I can do to resolve it?

1 Answer 1

3

The Mac is enrolled in ABM (Apple Business Manager).

Only the company that actually owns the machine can ask for it to be removed and only Apple can remove it.

If your company bought the machine new, they have proof of purchase/proof of ownership and Apple will remove it. If your company bought it used, then it was stolen from or remaindered from the listed owner, and you probably have no recourse.

2
  • Thank you for your reply! We did buy the machine new from Apple so I will contact them as suggested. However, I am concerned as to how the enrollment profile appeared here in the first place - as far as I can tell, MDMs are associated with the serial number of the machine. I actually called the company in question and they were kind enough to look up whether they owned this machine. My serial number does not appear anywhere in their records. How then can my machine be accessing their enrollment profile seemingly out of nowhere?
    – Amy Renne
    Apr 18, 2023 at 23:33
  • It's not "accessing it out of nowhere". The serial number is enrolled in ABM, the Mac checked in with ABM, the machine downloaded the profile. Apr 19, 2023 at 13:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .