csrutil disable
Restart computer
In the terminal, type
sudo open /Applications/TextEdit.app /System/Library/LaunchDaemons/com.apple.ManagedClient.enroll.plist
change
<key>com.apple.ManagedClient.enroll</key>
<true/>
to
<key>com.apple.ManagedClient.enroll</key>
<false/>
So that the changes take effect
The pinned guide didn't work for me (Sonoma 14.3, MBP M3). I couldn't edit the .plist files as instructed (the file is read-only and sudo didn't help). What worked for me though was this very simple guide.
csrutil disable and reboot in normal modesudo su
cd /var/db/ConfigurationProfiles
rm -rf *
mkdir Settings
touch Settings/.profilesAreInstalledcsrutil enable. Reboot to normal mode. You shouldn't see the unremovable profiles again in System Preferences/Profiles
Hope this comment is now visible - it got hidden due to a problem with my account.
(Cross post to https://gist.github.com/henrik242/65d26a7deca30bdb9828e183809690bd?permalink_comment_id=4912658#gistcomment-4912658).
I managed getting rid of spyware and worse w/ Sonoma (14.3.1). So any statement that's not possible at all is wrong.
System Info (redacted, personal information filtered)
>sudo sysinfo Software: System Software Overview: System Version: macOS 14.3.1 (23D60) Kernel Version: Darwin 23.3.0 Boot Volume: Macintosh HD Boot Mode: Normal Computer Name: <> User Name: System Administrator (root) Secure Virtual Memory: Enabled System Integrity Protection: Enabled Time since boot: <> Hardware: Hardware Overview: Model Name: MacBook Pro Model Identifier: Mac15,9 Model Number: <> Chip: Apple M3 Max Total Number of Cores: 16 (12 performance and 4 efficiency) Memory: 128 GB System Firmware Version: 10151.81.1 OS Loader Version: 10151.81.1 Serial Number (system): <> Hardware UUID: <> Provisioning UDID: <> Activation Lock Status: Disabled>sudo profiles list There are no configuration profiles installed in the system domain >sudo profiles show -type enrollment Error fetching Device Enrollment configuration: We can't determine if this machine is DEP enabled. Try again later.Approach: Clean Wipe, Router Filter, skipmdm.com Script
This approach assumes you are able to create a bootable installer and wipe your system disk (be sure to have a backup in place!).
Prerequisites
- Create bootable installer (I followed these instructions: https://mrmacintosh.com/how-to-create-a-macos-sonoma-usb-boot-disk-installer-in-5-min/)
- Have another external drive (e.g. USB stick) at hand and save the skipmdm.com script (https://raw.githubusercontent.com/skipmdm-phoenixbot/skipmdm.com/main/Autobypass-mdm.sh) on it.
- You have access to the internet router you use to activate macOS.
Block Apple URLs
Before starting at all, make sure you block the following URLs in the internet router. I used a Fritz!Box and here the ("Blocked websites" filter) to block these URLs:
iprofiles.apple.com mdmenrollment.apple.com deviceenrollment.apple.com gdmf.apple.com acmdm.apple.com albert.apple.comMake sure the blocker works (i.e. ping from another device)!
Clean Install
In recovery mode, wipe the hard disk and start a clean install with the bootable installer.
Activate the system
Connect to the internet once to activate the system (I could not proceed without). As the installer fails to connect to the enrollment servers, an error message will be displayed indicating that the status of the enrollment could not be verified.
Run the Script
In recovery mode, open Terminal and e.g. try to delete /var/db/ConfigurationProfiles/Settings - you should get a prompt for the installation user (starting w/ "_m...") - which is a good sign (no other users set up so far)!
Now just run the script from the USB stick. Hint: directly enter the username you'd like to use later (instead going w/ Apple:1234 - saves some time). The script should run without any errors (despite the long previous discussions).
Postwork
Block URLs in /etc/hosts
Before you proceed with the installation, reboot in recovery mode and change /etc/hosts by adding:
0.0.0.0 iprofiles.apple.com 0.0.0.0 mdmenrollment.apple.com 0.0.0.0 deviceenrollment.apple.com 0.0.0.0 gdmf..apple.com 0.0.0.0 acmdm.apple.com 0.0.0.0 albert.apple.comDisable agents
>sudo launchctl disable system/com.apple.ManagedClientAgent.enrollagent >sudo launchctl disable system/com.apple.mdmclient.daemon >sudo launchctl disable system/com.apple.devicemanagementclient.teslad # You might check other services and disable them - know what you do! >sudo launchctl print system | sort | grep enabledLittle Snitch
Finally a firewall comes in handy to possibly add even more security: I blocked
/usr/libexec/teslad /usr/libexec/mdmclient(for both user + system).
This works well for me and shows that it's possible to stop companies from installing spyware on their employees' devices - even on M3. B.t.w. - in many countries these practices are unlawful, so I see following this approach justified as a way of self-defense.
FWIW, this worked for me. Some of the steps might need to be more prescriptive for folks not very familiar with Macs, but I got it working in one pass. If you want a different drive name than "Macintosh HD" you will need to edit the global constant lines of Autobypass-mdm.sh to reflect the drive name you want.
I did have to connect to the internet to activate as well, but as soon as I hit the "This device is owned by an organization" page, I hit COMMAND-Q, booted in to Recovery Mode, then picked up the instructions from there and ran the script.
After using the method above to get to 14.3.1, how should I proceed to get to 14.4 or future 14.x updates?
Edit-
After no responses, I decided to try using the System Settings Software Updater, that seems to have worked as expected, and so far no enrollment screens after a couple days.
Disable annoying Remote Management Pop-Up after upgrading to macOS Sonoma (14)
Apple further added a new gate preventing people from using their DEP-enabled Macs without installing the profiles in macOS Sonoma. After upgrading from a fully-working Ventura copy (with MDM servers blocked in hosts) to macOS Sonoma DP 1, your Mac will want to give you a pop-up window every 10 mins reminding you to install a DEP profile. Did some experiments and I think Apple is secretly pinging their MDM servers no matter you have an active profile associated w/ SN or not. As long as the servers are not reachable they will annoy you with their new pop-up system.
The Workaround
(1) Disable SIP in 1 True Recovery
(2) sudo rm /var/db/ConfigurationProfiles/Settings/.cloudConfigHasActivationRecord
sudo rm /var/db/ConfigurationProfiles/Settings/.cloudConfigRecordFound
sudo touch /var/db/ConfigurationProfiles/Settings/.cloudConfigProfileInstalled
sudo touch /var/db/ConfigurationProfiles/Settings/.cloudConfigRecordNotFound
(3) you're all set. enjoy this boring upgrade
Can’t believe it but I think it worked! Thank you so much!
After using the method above to get to 14.3.1, how should I proceed to get to 14.4 or future 14.x updates?
Edit-
After no responses, I decided to try using the System Settings Software Updater, that seems to have worked as expected, and so far no enrollment screens after a couple days.
How did you manage to see the update in System Settings? Mine just says "your Mac is up to date"....
/etc/hosts
Check your host file and deblock "gdmf.apple.com"
/etc/hosts
Check your host file and deblock "gdmf.apple.com"
It worked, I can see the update to 14.4 now. Can this be left unlocked for the future updates?
FWIW, I had the following FQDNs blocked at the router:
iprofiles.apple.com
mdmenrollment.apple.com
deviceenrollment.apple.com
gdmf.apple.com
acmdm.apple.com
albert.apple.com
I had them blocked in /etc/hosts as well. Still was able to update. Based on a quick search, gdmf.apple.com is specifically for MDM-managed devices.
Here is a list of all the FQDNs for the various services Apple devices might use
I have an unmanaged iMac and a used-to-be-managed Macbook Pro on my home network. My employer sends out alerts when there are major MacOS updates, critical updates, & patches. When the 14.4 notice came out, I went in to Software Update on both systems, and the 14.4 update showed up automagically as expected. No unblocking on my part.
If you truly do HAVE to unblock gdmf.apple.com to get updates, your machine may actually still be enrolled, but some other step in one of the techniques here suppresses the nag messages.
To check that, open Terminal and enter the following command:
profiles status -type enrollment
Your results should be :
Enrolled via DEP: No
MDM enrollment: No
To check that, open Terminal and enter the following command:
profiles status -type enrollment
I run the command and I see "No" to all...
Greetings, Do you know if there is a way to log in with this Macbook Air 2020 with Intel, it has remote administration with Jamf, it asks me to log in with a Microsoft business account when using a personal account it does not allow it and when giving local login it asks me for a password but I do not have it.
If there is any option?
FWIW, this worked for me. Some of the steps might need to be more prescriptive for folks not very familiar with Macs, but I got it working in one pass. If you want a different drive name than "Macintosh HD" you will need to edit the global constant lines of Autobypass-mdm.sh to reflect the drive name you want.
I did have to connect to the internet to activate as well, but as soon as I hit the "This device is owned by an organization" page, I hit COMMAND-Q, booted in to Recovery Mode, then picked up the instructions from there and ran the script.
Just adding that this post in reply to the above method is what got me sorted out. Clean install (didn't have to use USB), reboot to recovery at the MDM screen, run bypass script and reboot. Dead simple.
what’s supposed to be done ?
Anyone using Sonoma 14.4.1, after processing the post?
Anyone using Sonoma 14.4.1, after processing the post?
yes it's working normaly
Just for info, for who had disk errors during the script run, it is updated with a fixed disk naming issue
https://github.com/skipmdm-phoenixbot/skipmdm.com/blob/main/Autobypass-mdm.sh