Hacker News Reader

Comment by hangonhn | Hacker News Reader

You can wipe it and reinstall. This happened to me by accident. The software for enrollment at my company didn't work correctly when I got my new MBP during my hardware refresh. Not knowing any better, I figured the MBP to MBP transfer process messed up my new MBP. So I just wiped my new MBP and reinstalled the OS. Of course, this also meant my new MBP was no longer enrolled and was unable to get all the software distributed by the enrollment agent. Once IT figured out what happened, I had to wipe it a second time and do the enrollment process again using some company specific image that was somehow accessible from my home -- maybe from a backup partition?

(Edited: the comments indicates this is no longer possible)

View on HN

No you can't. You can wipe & reinstall, but once the Mac reboots and connects to the internet, it re-installs whatever it is that the "owner" (through device enrollment) wants installed. The only way is to get the "owner" (or Apple) to release it.

You're correct that that is the only permanent solution, but it can be bypassed until the next reinstall or major OS upgrade on Macs like this one as long as (1) you're able to change the boot device and (2) there is not a firmware password set.

I did it a couple years ago on a last generation Intel-based MBP to troubleshoot a problem caused by a particular piece of software installed by our IT team who, for various reasons, were unable to assist.

Caveat: I don't know if this is possible anymore on Apple silicon-based Macs because they apparently "require an internet connection to get firmware and other information specific to the Mac model."[^1]

The trick was to:

1. Use a freshly created bootable installer volume.[^1] (If previously setup, management software will often inject itself into the existing Recovery volume).

2. Prevent it from connecting to the internet, including any previously connected WiFi network it might remember.

3. Get it through the installation and initial user creation without being able to connect to the internet.

After that, it didn't pester me until the next reinstall.

[^1]: https://support.apple.com/en-us/101578

> Caveat: I don't know if this is possible anymore on Apple silicon-based Macs because they apparently "require an internet connection to get firmware and other information specific to the Mac model."[^1]

On an Apple Silicon Mac you may have to install Monterey first, which doesn't require internet, do some incantantions, and then you can upgrade to Sonoma with no issue, and DEP/MDM bypassed.

That’s not true anymore. Now if enrollment is required because the computer was bought for a company, you cannot bypass it anymore (just like for iPhones).

This was not experience when I installed Sonoma on an M2 MBP a few months ago. Enrollment was easily skipped by blocking connection to the enrollment server.

I realize this may be straightforqard for an IT admin with creds, but does this hold of the avg user? How about avg engineer?

>>>>Easily skipped .....by blocking connection to enrollment server

I don't have any special MDM creds, but I do have an admin account on my OS.

Probably not the avg user or engineer (though giving engineers admin account on their local OS is common). But that's hard to predict because usually you'd want to enroll, so I don't often see people trying to avoid it. Usually it's because of a bug. In my experience if the MDM process is buggy then it's more likely to be bypassable.

Setting a firmware password and blocking boot to external drives makes it harder, but a lot of orgs don't do it.

Even a relatively non-technical user could do so.

Last instructions I saw and tested said "install Monterey with no internet connection, open terminal, sudo nano /etc/hosts, add these three entries, save, close, upgrade to Sonoma".

That fully disabled MDM/DEP on an M2 MBP. Not sure if it would periodically ping after install/upgrade, but is about as clean as it gets, and for now survives OS upgrades.

I'm wondering, does the machine only check enrollment once? What if a future OS update institutes regular checks?

It checks again unless the user cripples the service (which requires access to disable System Integrity Protection), and even if they do it will be undone after am update. But it requires the user to accept the enrollment (just a couple clicks on a pop up). I don't know that that can be changed.

During OS install the enrollment will just happen; the user's acceptance is not required.

You can zero route a few DNS entries at your router, and be fine, and then if you want, edit /etc/hosts. I've seen this work with Sonoma through multiple upgrades.

Reply on news.ycombinator.com