6 ms·

Out of interest, what would happen if you didn't have proof of purchase or if, somehow, one day in the future Apple ceased to exist and enrollment became imposs

Out of interest, what would happen if you didn't have proof of purchase or if, somehow, one day in the future Apple ceased to exist and enrollment became impossible? Would the computer be "bricked" by this or could you wipe it and install a fresh copy of MacOS?

hangonhn 3y ago
You can wipe it and reinstall. This happened to me by accident. The software for enrollment at my company didn't work correctly when I got my new MBP during my hardware refresh. Not knowing any better, I figured the MBP to MBP transfer process messed up my new MBP. So I just wiped my new MBP and reinstalled the OS. Of course, this also meant my new MBP was no longer enrolled and was unable to get all the software distributed by the enrollment agent. Once IT figured out what happened, I had to wipe it a second time and do the enrollment process again using some company specific image that was somehow accessible from my home -- maybe from a backup partition? (Edited: the comments indicates this is no longer possible)
- frizlab 3y ago
  That’s not true anymore. Now if enrollment is required because the computer was bought for a company, you cannot bypass it anymore (just like for iPhones).
  - joombaga 3y ago
    This was not experience when I installed Sonoma on an M2 MBP a few months ago. Enrollment was easily skipped by blocking connection to the enrollment server.
    - IG_Semmelweiss 3y ago
      I realize this may be straightforqard for an IT admin with creds, but does this hold of the avg user? How about avg engineer? >>>>Easily skipped .....by blocking connection to enrollment server
      - joombaga 3y ago
        I don't have any special MDM creds, but I do have an admin account on my OS. Probably not the avg user or engineer (though giving engineers admin account on their local OS is common). But that's hard to predict because usually you'd want to enroll, so I don't often see people trying to avoid it. Usually it's because of a bug. In my experience if the MDM process is buggy then it's more likely to be bypassable. Setting a firmware password and blocking boot to external drives makes it harder, but a lot of orgs don't do it.
      - FireBeyond 3y ago
        Even a relatively non-technical user could do so. Last instructions I saw and tested said "install Monterey with no internet connection, open terminal, sudo nano /etc/hosts, add these three entries, save, close, upgrade to Sonoma". That fully disabled MDM/DEP on an M2 MBP. Not sure if it would periodically ping after install/upgrade, but is about as clean as it gets, and for now survives OS upgrades.
    - benji-york 3y ago
      I'm wondering, does the machine only check enrollment once? What if a future OS update institutes regular checks?
      - joombaga 3y ago
        It checks again unless the user cripples the service (which requires access to disable System Integrity Protection), and even if they do it will be undone after am update. But it requires the user to accept the enrollment (just a couple clicks on a pop up). I don't know that that can be changed. During OS install the enrollment will just happen; the user's acceptance is not required.
        FireBeyond 3y ago
        You can zero route a few DNS entries at your router, and be fine, and then if you want, edit /etc/hosts. I've seen this work with Sonoma through multiple upgrades.
- lsllc 3y ago
  No you can't. You can wipe & reinstall, but once the Mac reboots and connects to the internet, it re-installs whatever it is that the "owner" (through device enrollment) wants installed. The only way is to get the "owner" (or Apple) to release it.
  - runlevel1 3y ago
    You're correct that that is the only permanent solution, but it can be bypassed until the next reinstall or major OS upgrade on Macs like this one as long as (1) you're able to change the boot device and (2) there is not a firmware password set. I did it a couple years ago on a last generation Intel-based MBP to troubleshoot a problem caused by a particular piece of software installed by our IT team who, for various reasons, were unable to assist. Caveat: I don't know if this is possible anymore on Apple silicon-based Macs because they apparently "require an internet connection to get firmware and other information specific to the Mac model."[^1] The trick was to: 1. Use a freshly created bootable installer volume.[^1] (If previously setup, management software will often inject itself into the existing Recovery volume). 2. Prevent it from connecting to the internet, including any previously connected WiFi network it might remember. 3. Get it through the installation and initial user creation without being able to connect to the internet. After that, it didn't pester me until the next reinstall. [^1]: https://support.apple.com/en-us/101578 https://support.apple.com/en-us/101578
    - FireBeyond 3y ago
      > Caveat: I don't know if this is possible anymore on Apple silicon-based Macs because they apparently "require an internet connection to get firmware and other information specific to the Mac model."[^1] On an Apple Silicon Mac you may have to install Monterey first, which doesn't require internet, do some incantantions, and then you can upgrade to Sonoma with no issue, and DEP/MDM bypassed.
hedora 3y ago
I’d hope it would be bricked, since that’s the point of this feature. (I wouldn’t want a laptop with this feature, but I can imagine the sort of people that administer MDM asking for it.
- josephcsible 3y ago
  > I’d hope it would be bricked, since that’s the point of this feature. I wouldn't. A previous owner or manufacturer should never be able to brick hardware against the current owner's wishes.
  - hedora 3y ago
    In this situation, the current owner opted into the feature. I’d agree if it applied to normal consumer laptops (even if opt-out) but that doesn’t seem to be the case here.
  - mcosta 3y ago
    Yes but, in Apple's eyes, Who is the owner?
millzlane 3y ago
Expedia would need to release the device from their ASM/DEP portal. Or apple needs to.
danaris 3y ago
Now, this is speculation on my part, but... I think if Apple went out of business the service that's causing this problem wouldn't even function anymore, because I believe it relies on the MBP phoning home during the setup process and being informed that it belongs to the Expedia MDM group. This would then be why fixing it requires a call to Apple, rather than being something you can do simply by wiping settings on the device itself. (However, I don't know whether this means that booting it in a Faraday cage, or just with the internet disabled, after wiping device settings would allow bypassing it.)

hangonhn 3y ago

You can wipe it and reinstall. This happened to me by accident. The software for enrollment at my company didn't work correctly when I got my new MBP during my hardware refresh. Not knowing any better, I figured the MBP to MBP transfer process messed up my new MBP. So I just wiped my new MBP and reinstalled the OS. Of course, this also meant my new MBP was no longer enrolled and was unable to get all the software distributed by the enrollment agent. Once IT figured out what happened, I had to wipe it a second time and do the enrollment process again using some company specific image that was somehow accessible from my home -- maybe from a backup partition? (Edited: the comments indicates this is no longer possible)

frizlab 3y ago
That’s not true anymore. Now if enrollment is required because the computer was bought for a company, you cannot bypass it anymore (just like for iPhones).
- joombaga 3y ago
  This was not experience when I installed Sonoma on an M2 MBP a few months ago. Enrollment was easily skipped by blocking connection to the enrollment server.
  - IG_Semmelweiss 3y ago
    I realize this may be straightforqard for an IT admin with creds, but does this hold of the avg user? How about avg engineer? >>>>Easily skipped .....by blocking connection to enrollment server
    - joombaga 3y ago
      I don't have any special MDM creds, but I do have an admin account on my OS. Probably not the avg user or engineer (though giving engineers admin account on their local OS is common). But that's hard to predict because usually you'd want to enroll, so I don't often see people trying to avoid it. Usually it's because of a bug. In my experience if the MDM process is buggy then it's more likely to be bypassable. Setting a firmware password and blocking boot to external drives makes it harder, but a lot of orgs don't do it.
    - FireBeyond 3y ago
      Even a relatively non-technical user could do so. Last instructions I saw and tested said "install Monterey with no internet connection, open terminal, sudo nano /etc/hosts, add these three entries, save, close, upgrade to Sonoma". That fully disabled MDM/DEP on an M2 MBP. Not sure if it would periodically ping after install/upgrade, but is about as clean as it gets, and for now survives OS upgrades.
  - benji-york 3y ago
    I'm wondering, does the machine only check enrollment once? What if a future OS update institutes regular checks?
    - joombaga 3y ago
      It checks again unless the user cripples the service (which requires access to disable System Integrity Protection), and even if they do it will be undone after am update. But it requires the user to accept the enrollment (just a couple clicks on a pop up). I don't know that that can be changed. During OS install the enrollment will just happen; the user's acceptance is not required.
      - FireBeyond 3y ago
        You can zero route a few DNS entries at your router, and be fine, and then if you want, edit /etc/hosts. I've seen this work with Sonoma through multiple upgrades.
lsllc 3y ago
No you can't. You can wipe & reinstall, but once the Mac reboots and connects to the internet, it re-installs whatever it is that the "owner" (through device enrollment) wants installed. The only way is to get the "owner" (or Apple) to release it.
- runlevel1 3y ago
  You're correct that that is the only permanent solution, but it can be bypassed until the next reinstall or major OS upgrade on Macs like this one as long as (1) you're able to change the boot device and (2) there is not a firmware password set. I did it a couple years ago on a last generation Intel-based MBP to troubleshoot a problem caused by a particular piece of software installed by our IT team who, for various reasons, were unable to assist. Caveat: I don't know if this is possible anymore on Apple silicon-based Macs because they apparently "require an internet connection to get firmware and other information specific to the Mac model."[^1] The trick was to: 1. Use a freshly created bootable installer volume.[^1] (If previously setup, management software will often inject itself into the existing Recovery volume). 2. Prevent it from connecting to the internet, including any previously connected WiFi network it might remember. 3. Get it through the installation and initial user creation without being able to connect to the internet. After that, it didn't pester me until the next reinstall. [^1]: https://support.apple.com/en-us/101578 https://support.apple.com/en-us/101578
  - FireBeyond 3y ago
    > Caveat: I don't know if this is possible anymore on Apple silicon-based Macs because they apparently "require an internet connection to get firmware and other information specific to the Mac model."[^1] On an Apple Silicon Mac you may have to install Monterey first, which doesn't require internet, do some incantantions, and then you can upgrade to Sonoma with no issue, and DEP/MDM bypassed.

hedora 3y ago

I’d hope it would be bricked, since that’s the point of this feature. (I wouldn’t want a laptop with this feature, but I can imagine the sort of people that administer MDM asking for it.

josephcsible 3y ago
> I’d hope it would be bricked, since that’s the point of this feature. I wouldn't. A previous owner or manufacturer should never be able to brick hardware against the current owner's wishes.
- hedora 3y ago
  In this situation, the current owner opted into the feature. I’d agree if it applied to normal consumer laptops (even if opt-out) but that doesn’t seem to be the case here.
- mcosta 3y ago
  Yes but, in Apple's eyes, Who is the owner?

millzlane 3y ago

Expedia would need to release the device from their ASM/DEP portal. Or apple needs to.

danaris 3y ago

Now, this is speculation on my part, but... I think if Apple went out of business the service that's causing this problem wouldn't even function anymore, because I believe it relies on the MBP phoning home during the setup process and being informed that it belongs to the Expedia MDM group. This would then be why fixing it requires a call to Apple, rather than being something you can do simply by wiping settings on the device itself. (However, I don't know whether this means that booting it in a Faraday cage, or just with the internet disabled, after wiping device settings would allow bypassing it.)