6 ms·

Why is my Mac trying to force me to enroll with Expedia Group upon installation?

114 points by josephcsible 3y ago

easton 3y ago
I'm curious how that happened in the first place. Telling Apple that you want a mac to be autoenrolled in MDM after purchase requires you giving them the same proof of purchase you would need to get it unenrolled. (At least, it used to. I know now definitely for iOS devices you can get them set up in Automated Enrollment via Configurator) Someone at Expedia would've needed the receipt for this laptop to get it enrolled, or someone at Apple fat fingered the serial number and accidentally enrolled that person's laptop?
- andrepew 3y ago
  I imagine it was a fat fingering. I’ve purchased MBPs for my org in person at an Apple Store because I needed them urgently and I had to call my Apple rep to manually assign the serials to our company in ABM.
  - ArnoVW 3y ago
    You can manually assign MacBooks to your Apple Business account. Just install Apple Configurator on an iPhone and hold the phone close to the laptop at initial boot. It will show a sort of QR code and when you scan it it’s attached. The initial detection will only trigger when it is in the “choose locale” screen, just after the very first “choose language” screen. If you go beyond “choose locale” it will not work, even if you go back a step, and even if you reboot. Then in ABM change the MDM platform to whatever you want (your Jamf instance) and Bob’s your uncle
    - kristjansson 3y ago
      That is simultaneously (a) so freaking cool and (b) the most nonobvious, undiscoverable UI/UX I've ever heard of. "How do you do this sort-of complex business process to a new apple device?" "Oh just install this app on your phone, then hold the phone next to the computer when you turn it on. No, don't open the app. No, don't lock the phone. No, don't click anything on the computer, lest you go too far."
      - ArnoVW 3y ago
        It’s documented. I assure you I didn’t find that by accident =)
- anonymouse008 3y ago
  Probably a return/cancelled order from Apple Managed side, then ended up in general inventory. Evidently there are two completely separate customer relationship systems, which makes sense given the amount of power given to managed accounts (truthfully still boggles my mind the dev and managed aren’t the same system with the amount of similar power). I would have thought inventory would be separated though, but stranger things happen.
  - millzlane 3y ago
    If that is the case, either Expedia, didn't release the device before sending it back to apple. Or apple didn't release the device from ASM before re-selling the device.
  - kotaKat 3y ago
    Yep. Had a friend ironically get an Apple Demo Management configured Apple TV from an Apple Store. That was a quick trip back...
neverrroot 3y ago
When companies purchase Macs, the serial numbers of those Macs could be associated with the respective purchasing company for enrollment purposes. Mistakes could happen, but also new (or for that purpose even used) Macs could end up being sold before their serial numbers is disassociated with the company purchasing them.
- oneepic 3y ago
  That makes a lot of sense. Expedia used Macs heavily when I worked there.
wackget 3y ago
Out of interest, what would happen if you didn't have proof of purchase or if, somehow, one day in the future Apple ceased to exist and enrollment became impossible? Would the computer be "bricked" by this or could you wipe it and install a fresh copy of MacOS?
- hangonhn 3y ago
  You can wipe it and reinstall. This happened to me by accident. The software for enrollment at my company didn't work correctly when I got my new MBP during my hardware refresh. Not knowing any better, I figured the MBP to MBP transfer process messed up my new MBP. So I just wiped my new MBP and reinstalled the OS. Of course, this also meant my new MBP was no longer enrolled and was unable to get all the software distributed by the enrollment agent. Once IT figured out what happened, I had to wipe it a second time and do the enrollment process again using some company specific image that was somehow accessible from my home -- maybe from a backup partition? (Edited: the comments indicates this is no longer possible)
  - frizlab 3y ago
    That’s not true anymore. Now if enrollment is required because the computer was bought for a company, you cannot bypass it anymore (just like for iPhones).
    - joombaga 3y ago
      This was not experience when I installed Sonoma on an M2 MBP a few months ago. Enrollment was easily skipped by blocking connection to the enrollment server.
      - IG_Semmelweiss 3y ago
        I realize this may be straightforqard for an IT admin with creds, but does this hold of the avg user? How about avg engineer? >>>>Easily skipped .....by blocking connection to enrollment server
millzlane 3y ago
We recently are in the process of trying to return a MacBook to apple and avoid them dinging our return allotment. My store sold to a customer who later called us and said it was making them enroll into a PA University's MDM. This was a device that apple sold to us directly.
Longlius 3y ago
I hear a ton of stories about managed devices ending up in the hands of general consumers with Apple machines specifically... I wonder why? Is Apple particularly sloppy in this regard or is this just a matter of Apple computers being extremely popular for deployment with MDM?
- deleted 3y ago
  [deleted]
- skyleradams 3y ago
  Most of the time they’re stolen and resold to unsuspecting buyers on secondhand markets
- chris_wot 3y ago
  The school I work for once had a student who had left the school sell a MacBook to an unsuspecting member of the public. It hadn’t been unenrolled. We wrote it off and removed it from DEP for the poor guy. The student was long since gone and we had depreciated it anyway, so it wasn’t a huge loss. We realised not doing so was also potentially a reputation issue for the school also. We’ve since tightened up leaving processes so this is unlikely to happen again.
- jmbwell 3y ago
  The latter. MDM is way ahead on Macs, imho. Intune and Autopilot with Windows 10/11 and Azure are only just now catching up to what MDM and Jamf can do on Macs, or even what Group Policy can do on local devices. The decommissioning process should generally catch these situations, but it’s not foolproof, and not all organizations have robust decom procedures. A lot of Macs are managed by like a University IT dept, but procured and released by individual departments, for example. The school of business might not bother to notify central IT that they’ve let go of a bunch of old equipment, for example, and if they do it’s in some outdated spreadsheet, so the machines don’t get released properly. Things like that.
  - kotaKat 3y ago
    Funny thing is that Intune/Autopilot aren't infallible either to this regard. I acquired one of those weird lil' mini PCs that are all the rage, from Minisforum. The BIOS UUID was, essentially, 1-2-3-4-5, if we omit all the zeros. That UUID somehow tripped a fresh Windows install into Autopilot mode on the box to some random company that enrolled a similarly "blank" UUID in. I was absolutely befuddled and laughing my ass off once I figured out what happened... after the shock wore off of sitting at a Miratech Azure AD login. ... then dug out an AMI utility to go re-roll the RNG on the UUID since the OEM didn't do it and reinstalled Windows again and all was well in the world. You'll also find this happens when you get a Mini PC with a sticker telling you "if you cannot log into your personal account, please turn off WiFi and LAN, select the skip option, and then log in"... All they need to do is boot a damn flash drive. `AMIDEWINx64 /su auto` for the win... also thanks to Lenovo for accidentally leaving that executable in some BIOS updates.
gigel82 3y ago
I had no idea this feature exists; do PCs have this "feature" too? Are we now saying a central authority can simply brick or forcefully install software on any mac at any time given only the serial number? What the actual fuck!? Is this an OS feature or part of the "secure enclave" (Are macs entirely useless now or can you install Linux and still trust the device)?
- chris_wot 3y ago
  They can. Surfacebooks can be enrolled into Autopilot. Any OEM device running Windows 11 can be preenrolled. It’s actually a pretty good feature for managing laptop fleets.
- charcircuit 3y ago
  >Are we now saying a central authority can simply brick or forcefully install software on any mac at any time given only the serial number? Apple can brick or install an update to your computer even without MDM. For MDM you can not be spontaneously enrolled. In the article the user didn't notice this had been done until he reformatted his device.
- jmbwell 3y ago
  This is a corporate device management facility. It exists for both Windows and Macs. With Macs, it’s more closely tied to the hardware because of course they’re integrated. With PCs, Intune and Autopilot are Windows features that depend on hardware, but hardware alone isn’t sufficient. You can install and run Linux or DOS all you want on an Autopilot enrolled device, but every time you boot Windows it will want to phone home. It’s fairly carefully controlled. With a PC, serial number is not sufficient. You need a device specific hash that is not generated and that you can’t get until you turn on the computer at least once, so you need physical possession at some point in the workflow. With Macs, Apple more completely manages those first stages of enrollment. Devices are enrolled when sold through a B2B channel, or when manually enrolled through Business Manager. Either way, it would be difficult for an adversary to assume control of a device without authorization. Not impossible, surely, but it’s definitely a scenario these vendors have anticipated and worked to prevent. The good news for device owners is that it adds complexity to resale of a stolen device. The bad news is things like OP’s situation occur.
runjake 3y ago
We have some poor soul in Puerto Rico who has a MacBook Pro that is tied to our MDM system and, for whatever reason, it cannot be removed. The closest we can tell is that he sent his MBP off to Apple for repair and they swapped the logic board with a refurb unit that was swapped from one of our machines. There is some internal tool that rewrites the serial number and apparently nobody ever overwrote the serial number on the removed unit. So anyway, there's two legitimate MBPs out there with the same serial number, although ours is probably decommissioned by now (I believe it was a 2015). Was a funny journey figuring out what the hell was going on, though.
- ComputerGuru 3y ago
  Can’t you remotely deprovision the machine?
  - innocenat 3y ago
    Can't see how that would go well if two devices have the same serial number.
  - I_Am_Nous 3y ago
    That sounds like something that might also wipe the laptop...and all of the new owner's data with it.
    - gtirloni 3y ago
      That's Apple's problem. For all this company knows, someone is using a laptop with their data on it.
- MichaelZuo 3y ago
  > There is some internal tool that rewrites the serial number and apparently nobody ever overwrote the serial number on the removed unit. How could that be possible? Apple's internal systems won't allow a second motherboard/computer with the same serial to even pass the post-repair diagnosis.
Animats 3y ago
"Contact Apple support with your purchase details and ask them to fix the enrollment of the serial number on the affected Mac. It sounds like there was a clerical mixup on the record keeping as part of automated device enrollment." Funny how these "mixups" always seem to benefit the company trying to control the user.
- ziml77 3y ago
  The mixups go in both directions https://news.ycombinator.com/item?id=38724253 https://news.ycombinator.com/item?id=38724253 Also I'm not really sure what benefit you're saying Apple even gets here. They have to waste time confirming all sorts of details so they don't unenroll a stolen device from MDM. Just seems like it's nothing but a pain for everyone involved.
tcfunk 3y ago
Interesting, I recently got a MPB for a new job that was supposed to have some enrollment pre-configured, but didn't. Weeks into my new job, the IT folks contacted me and asked "Uh, did you ever get your laptop?"
annoyingcyclist 3y ago
I had this happen with an iPad that I received as an exchange when I sent one in for a repair. I booted the new unit up and was prompted to enroll the device in MDM for a school district in Florida. Kind of a frustrating experience, but Apple support was eventually able to get it unenrolled after enough escalations ("yes, I bought it from you", "no, I'm not going to sign in to an MDM-enrolled device with my personal Apple ID", "no, I've never heard of this school district and don't know anyone in IT there who could unenroll the device", "yes, I'm quite sure I didn't buy it off a truck"). I never learned what caused the issue.
someonehere 3y ago
This could easily been Expedia’s VAR submitting the serials to Apple Business Manager and having one of them off by a character. I would assume Expedia buys in bulk so it’s possible all the serials that were scanned in could have had one or several serials entered wrong. Generally when you buy a batch/bulk order, the last four will be different than the initial 8 for several dozen machines in that batch.
tallmed 3y ago
Gnu/Linux doesn't have this problem
- terminous 3y ago
  It's in the hardware.
  - onyxringer 3y ago
    Enrolling into accounts is in the hardware?
NikkiA 3y ago
The used mac market is too risky, it's too easy for the seller to remote disable it, or it be locked into bullshit like this. I'm surprised anyone still dares to buy used.
- josephcsible 3y ago
  You make it sound like that's an unintended consequence, but I think that was Apple's goal all along.

114 points by josephcsible 3y ago

I'm curious how that happened in the first place. Telling Apple that you want a mac to be autoenrolled in MDM after purchase requires you giving them the same proof of purchase you would need to get it unenrolled. (At least, it used to. I know now definitely for iOS devices you can get them set up in Automated Enrollment via Configurator) Someone at Expedia would've needed the receipt for this laptop to get it enrolled, or someone at Apple fat fingered the serial number and accidentally enrolled that person's laptop?

andrepew 3y ago
I imagine it was a fat fingering. I’ve purchased MBPs for my org in person at an Apple Store because I needed them urgently and I had to call my Apple rep to manually assign the serials to our company in ABM.
- ArnoVW 3y ago
  You can manually assign MacBooks to your Apple Business account. Just install Apple Configurator on an iPhone and hold the phone close to the laptop at initial boot. It will show a sort of QR code and when you scan it it’s attached. The initial detection will only trigger when it is in the “choose locale” screen, just after the very first “choose language” screen. If you go beyond “choose locale” it will not work, even if you go back a step, and even if you reboot. Then in ABM change the MDM platform to whatever you want (your Jamf instance) and Bob’s your uncle
  - kristjansson 3y ago
    That is simultaneously (a) so freaking cool and (b) the most nonobvious, undiscoverable UI/UX I've ever heard of. "How do you do this sort-of complex business process to a new apple device?" "Oh just install this app on your phone, then hold the phone next to the computer when you turn it on. No, don't open the app. No, don't lock the phone. No, don't click anything on the computer, lest you go too far."
    - ArnoVW 3y ago
      It’s documented. I assure you I didn’t find that by accident =)
anonymouse008 3y ago
Probably a return/cancelled order from Apple Managed side, then ended up in general inventory. Evidently there are two completely separate customer relationship systems, which makes sense given the amount of power given to managed accounts (truthfully still boggles my mind the dev and managed aren’t the same system with the amount of similar power). I would have thought inventory would be separated though, but stranger things happen.
- millzlane 3y ago
  If that is the case, either Expedia, didn't release the device before sending it back to apple. Or apple didn't release the device from ASM before re-selling the device.
- kotaKat 3y ago
  Yep. Had a friend ironically get an Apple Demo Management configured Apple TV from an Apple Store. That was a quick trip back...

neverrroot 3y ago

When companies purchase Macs, the serial numbers of those Macs could be associated with the respective purchasing company for enrollment purposes. Mistakes could happen, but also new (or for that purpose even used) Macs could end up being sold before their serial numbers is disassociated with the company purchasing them.

oneepic 3y ago
That makes a lot of sense. Expedia used Macs heavily when I worked there.

wackget 3y ago

Out of interest, what would happen if you didn't have proof of purchase or if, somehow, one day in the future Apple ceased to exist and enrollment became impossible? Would the computer be "bricked" by this or could you wipe it and install a fresh copy of MacOS?

hangonhn 3y ago
You can wipe it and reinstall. This happened to me by accident. The software for enrollment at my company didn't work correctly when I got my new MBP during my hardware refresh. Not knowing any better, I figured the MBP to MBP transfer process messed up my new MBP. So I just wiped my new MBP and reinstalled the OS. Of course, this also meant my new MBP was no longer enrolled and was unable to get all the software distributed by the enrollment agent. Once IT figured out what happened, I had to wipe it a second time and do the enrollment process again using some company specific image that was somehow accessible from my home -- maybe from a backup partition? (Edited: the comments indicates this is no longer possible)
- frizlab 3y ago
  That’s not true anymore. Now if enrollment is required because the computer was bought for a company, you cannot bypass it anymore (just like for iPhones).
  - joombaga 3y ago
    This was not experience when I installed Sonoma on an M2 MBP a few months ago. Enrollment was easily skipped by blocking connection to the enrollment server.
    - IG_Semmelweiss 3y ago
      I realize this may be straightforqard for an IT admin with creds, but does this hold of the avg user? How about avg engineer? >>>>Easily skipped .....by blocking connection to enrollment server

millzlane 3y ago

We recently are in the process of trying to return a MacBook to apple and avoid them dinging our return allotment. My store sold to a customer who later called us and said it was making them enroll into a PA University's MDM. This was a device that apple sold to us directly.

Longlius 3y ago

I hear a ton of stories about managed devices ending up in the hands of general consumers with Apple machines specifically... I wonder why? Is Apple particularly sloppy in this regard or is this just a matter of Apple computers being extremely popular for deployment with MDM?

deleted 3y ago
[deleted]
skyleradams 3y ago
Most of the time they’re stolen and resold to unsuspecting buyers on secondhand markets
chris_wot 3y ago
The school I work for once had a student who had left the school sell a MacBook to an unsuspecting member of the public. It hadn’t been unenrolled. We wrote it off and removed it from DEP for the poor guy. The student was long since gone and we had depreciated it anyway, so it wasn’t a huge loss. We realised not doing so was also potentially a reputation issue for the school also. We’ve since tightened up leaving processes so this is unlikely to happen again.
jmbwell 3y ago
The latter. MDM is way ahead on Macs, imho. Intune and Autopilot with Windows 10/11 and Azure are only just now catching up to what MDM and Jamf can do on Macs, or even what Group Policy can do on local devices. The decommissioning process should generally catch these situations, but it’s not foolproof, and not all organizations have robust decom procedures. A lot of Macs are managed by like a University IT dept, but procured and released by individual departments, for example. The school of business might not bother to notify central IT that they’ve let go of a bunch of old equipment, for example, and if they do it’s in some outdated spreadsheet, so the machines don’t get released properly. Things like that.
- kotaKat 3y ago
  Funny thing is that Intune/Autopilot aren't infallible either to this regard. I acquired one of those weird lil' mini PCs that are all the rage, from Minisforum. The BIOS UUID was, essentially, 1-2-3-4-5, if we omit all the zeros. That UUID somehow tripped a fresh Windows install into Autopilot mode on the box to some random company that enrolled a similarly "blank" UUID in. I was absolutely befuddled and laughing my ass off once I figured out what happened... after the shock wore off of sitting at a Miratech Azure AD login. ... then dug out an AMI utility to go re-roll the RNG on the UUID since the OEM didn't do it and reinstalled Windows again and all was well in the world. You'll also find this happens when you get a Mini PC with a sticker telling you "if you cannot log into your personal account, please turn off WiFi and LAN, select the skip option, and then log in"... All they need to do is boot a damn flash drive. `AMIDEWINx64 /su auto` for the win... also thanks to Lenovo for accidentally leaving that executable in some BIOS updates.

gigel82 3y ago

I had no idea this feature exists; do PCs have this "feature" too? Are we now saying a central authority can simply brick or forcefully install software on any mac at any time given only the serial number? What the actual fuck!? Is this an OS feature or part of the "secure enclave" (Are macs entirely useless now or can you install Linux and still trust the device)?

chris_wot 3y ago
They can. Surfacebooks can be enrolled into Autopilot. Any OEM device running Windows 11 can be preenrolled. It’s actually a pretty good feature for managing laptop fleets.
charcircuit 3y ago
>Are we now saying a central authority can simply brick or forcefully install software on any mac at any time given only the serial number? Apple can brick or install an update to your computer even without MDM. For MDM you can not be spontaneously enrolled. In the article the user didn't notice this had been done until he reformatted his device.
jmbwell 3y ago
This is a corporate device management facility. It exists for both Windows and Macs. With Macs, it’s more closely tied to the hardware because of course they’re integrated. With PCs, Intune and Autopilot are Windows features that depend on hardware, but hardware alone isn’t sufficient. You can install and run Linux or DOS all you want on an Autopilot enrolled device, but every time you boot Windows it will want to phone home. It’s fairly carefully controlled. With a PC, serial number is not sufficient. You need a device specific hash that is not generated and that you can’t get until you turn on the computer at least once, so you need physical possession at some point in the workflow. With Macs, Apple more completely manages those first stages of enrollment. Devices are enrolled when sold through a B2B channel, or when manually enrolled through Business Manager. Either way, it would be difficult for an adversary to assume control of a device without authorization. Not impossible, surely, but it’s definitely a scenario these vendors have anticipated and worked to prevent. The good news for device owners is that it adds complexity to resale of a stolen device. The bad news is things like OP’s situation occur.

runjake 3y ago

We have some poor soul in Puerto Rico who has a MacBook Pro that is tied to our MDM system and, for whatever reason, it cannot be removed. The closest we can tell is that he sent his MBP off to Apple for repair and they swapped the logic board with a refurb unit that was swapped from one of our machines. There is some internal tool that rewrites the serial number and apparently nobody ever overwrote the serial number on the removed unit. So anyway, there's two legitimate MBPs out there with the same serial number, although ours is probably decommissioned by now (I believe it was a 2015). Was a funny journey figuring out what the hell was going on, though.

ComputerGuru 3y ago
Can’t you remotely deprovision the machine?
- innocenat 3y ago
  Can't see how that would go well if two devices have the same serial number.
- I_Am_Nous 3y ago
  That sounds like something that might also wipe the laptop...and all of the new owner's data with it.
  - gtirloni 3y ago
    That's Apple's problem. For all this company knows, someone is using a laptop with their data on it.
MichaelZuo 3y ago
> There is some internal tool that rewrites the serial number and apparently nobody ever overwrote the serial number on the removed unit. How could that be possible? Apple's internal systems won't allow a second motherboard/computer with the same serial to even pass the post-repair diagnosis.

Animats 3y ago

"Contact Apple support with your purchase details and ask them to fix the enrollment of the serial number on the affected Mac. It sounds like there was a clerical mixup on the record keeping as part of automated device enrollment." Funny how these "mixups" always seem to benefit the company trying to control the user.

ziml77 3y ago
The mixups go in both directions https://news.ycombinator.com/item?id=38724253 https://news.ycombinator.com/item?id=38724253 Also I'm not really sure what benefit you're saying Apple even gets here. They have to waste time confirming all sorts of details so they don't unenroll a stolen device from MDM. Just seems like it's nothing but a pain for everyone involved.

tcfunk 3y ago

Interesting, I recently got a MPB for a new job that was supposed to have some enrollment pre-configured, but didn't. Weeks into my new job, the IT folks contacted me and asked "Uh, did you ever get your laptop?"

annoyingcyclist 3y ago

I had this happen with an iPad that I received as an exchange when I sent one in for a repair. I booted the new unit up and was prompted to enroll the device in MDM for a school district in Florida. Kind of a frustrating experience, but Apple support was eventually able to get it unenrolled after enough escalations ("yes, I bought it from you", "no, I'm not going to sign in to an MDM-enrolled device with my personal Apple ID", "no, I've never heard of this school district and don't know anyone in IT there who could unenroll the device", "yes, I'm quite sure I didn't buy it off a truck"). I never learned what caused the issue.

someonehere 3y ago

This could easily been Expedia’s VAR submitting the serials to Apple Business Manager and having one of them off by a character. I would assume Expedia buys in bulk so it’s possible all the serials that were scanned in could have had one or several serials entered wrong. Generally when you buy a batch/bulk order, the last four will be different than the initial 8 for several dozen machines in that batch.

tallmed 3y ago

Gnu/Linux doesn't have this problem

terminous 3y ago
It's in the hardware.
- onyxringer 3y ago
  Enrolling into accounts is in the hardware?

NikkiA 3y ago

The used mac market is too risky, it's too easy for the seller to remote disable it, or it be locked into bullshit like this. I'm surprised anyone still dares to buy used.

josephcsible 3y ago
You make it sound like that's an unintended consequence, but I think that was Apple's goal all along.