This is also institutions using them wrong. You're supposed to enroll these things into DEP, which is annoying to shut up (boot into recovery, enable rw on syst

This is also institutions using them wrong. You're supposed to enroll these things into DEP, which is annoying to shut up (boot into recovery, enable rw on system partition, block deviceenrollment.apple.com via hosts, turn system integrity back on), but at worst the user will be asked to enroll their device every 4 hours.