Request: Bypassing removal of DEP Enrolled device (MacBook)

mrdoody · Sep 10, 2024

Hi,

I have a corporate enrolled Macbook device, it's enrolled in auto-mdm(DEP Enrolled), as far as I've researched on the internet, this can't be removed.

Is there a method to bypass this enrollment lock or am I screwed trying to use this device.

Another question I had in mind is where this dep-enrollment profile is stored, if its in the hard-drive, then a hard-drive change would be able to solve this issue, right?

mrdoody

mrdoody · Sep 10, 2024

I seem to have found a solution, all my tests indiciate that this method works.

What I have tested so far
1. Erased and reinstalled
2. Checked for profiles / mdm in settings
3. Run

Code:

sudo profiles show -type enrollment

with the output Error fetching Device Enrollment configuration: Client is not DEP enabled.

Code:
Instructions
Non-removable MDM profiles cannot officially removed without doing a full system wipe. This is a problem when you restore a system from Time Machine after you enrolled it into the MDM, as the MDM will break, leaving you unable to re-enroll the machine.

Here's how to remove a non-removable MDM profile

Boot the Mac into Recovery Mode (hold down command+R during startup).

Go to the Utilities menu and open Terminal and type: csrutil disable. This will disable SIP (System Integrity Protection).

Reboot into the OS.

Open the integrated terminal and type:

Code:

cd /var/db/ConfigurationProfiles rm -rf * mkdir Settings touch Settings/.profilesAreInstalled

Reboot.

Boot the Mac into Recovery Mode (hold down command+R during startup).

Go to the Utilities menu and open Terminal and type: csrutil enable. This will re-enable SIP.

Reboot into the OS.

The profile will be now removed and you will be able to re-enroll the Mac to your MDM.

Source:
https://graffino.com/til/remove-a-non-removable-mdm-profile-from-macos-without-a-complete-wipe

Questions that pops up to mind
How is this going to look on the managed platform end? (Either if that's ABM(Apple Business Manager) and/or JAMF or some similar MDM)

Will this device just not re-register because I've deleted the ConfigurationProfiles DB entry?

Is this entry the only area in which profiles are stored /var/db/ConfigurationProfiles, is there anything else to stay aware of?

Request: Bypassing removal of DEP Enrolled device (MacBook)

mrdoody

Newbie

mrdoody

Newbie

Here's how to remove a non-removable MDM profile

Main Menu

Marketplace

Making Money

BlackHat World

Request: Bypassing removal of DEP Enrolled device (MacBook)

mrdoody

Newbie

mrdoody

Newbie

Here's how to remove a non-removable MDM profile​

Main Menu

Marketplace

Making Money

BlackHat World

Here's how to remove a non-removable MDM profile