4 ms·

This was not experience when I installed Sonoma on an M2 MBP a few months ago. Enrollment was easily skipped by blocking connection to the enrollment server.

IG_Semmelweiss 3y ago
I realize this may be straightforqard for an IT admin with creds, but does this hold of the avg user? How about avg engineer? >>>>Easily skipped .....by blocking connection to enrollment server
- joombaga 3y ago
  I don't have any special MDM creds, but I do have an admin account on my OS. Probably not the avg user or engineer (though giving engineers admin account on their local OS is common). But that's hard to predict because usually you'd want to enroll, so I don't often see people trying to avoid it. Usually it's because of a bug. In my experience if the MDM process is buggy then it's more likely to be bypassable. Setting a firmware password and blocking boot to external drives makes it harder, but a lot of orgs don't do it.
- FireBeyond 3y ago
  Even a relatively non-technical user could do so. Last instructions I saw and tested said "install Monterey with no internet connection, open terminal, sudo nano /etc/hosts, add these three entries, save, close, upgrade to Sonoma". That fully disabled MDM/DEP on an M2 MBP. Not sure if it would periodically ping after install/upgrade, but is about as clean as it gets, and for now survives OS upgrades.
benji-york 3y ago
I'm wondering, does the machine only check enrollment once? What if a future OS update institutes regular checks?
- joombaga 3y ago
  It checks again unless the user cripples the service (which requires access to disable System Integrity Protection), and even if they do it will be undone after am update. But it requires the user to accept the enrollment (just a couple clicks on a pop up). I don't know that that can be changed. During OS install the enrollment will just happen; the user's acceptance is not required.
  - FireBeyond 3y ago
    You can zero route a few DNS entries at your router, and be fine, and then if you want, edit /etc/hosts. I've seen this work with Sonoma through multiple upgrades.

IG_Semmelweiss 3y ago

I realize this may be straightforqard for an IT admin with creds, but does this hold of the avg user? How about avg engineer? >>>>Easily skipped .....by blocking connection to enrollment server

joombaga 3y ago
I don't have any special MDM creds, but I do have an admin account on my OS. Probably not the avg user or engineer (though giving engineers admin account on their local OS is common). But that's hard to predict because usually you'd want to enroll, so I don't often see people trying to avoid it. Usually it's because of a bug. In my experience if the MDM process is buggy then it's more likely to be bypassable. Setting a firmware password and blocking boot to external drives makes it harder, but a lot of orgs don't do it.
FireBeyond 3y ago
Even a relatively non-technical user could do so. Last instructions I saw and tested said "install Monterey with no internet connection, open terminal, sudo nano /etc/hosts, add these three entries, save, close, upgrade to Sonoma". That fully disabled MDM/DEP on an M2 MBP. Not sure if it would periodically ping after install/upgrade, but is about as clean as it gets, and for now survives OS upgrades.

benji-york 3y ago

I'm wondering, does the machine only check enrollment once? What if a future OS update institutes regular checks?

joombaga 3y ago
It checks again unless the user cripples the service (which requires access to disable System Integrity Protection), and even if they do it will be undone after am update. But it requires the user to accept the enrollment (just a couple clicks on a pop up). I don't know that that can be changed. During OS install the enrollment will just happen; the user's acceptance is not required.
- FireBeyond 3y ago
  You can zero route a few DNS entries at your router, and be fine, and then if you want, edit /etc/hosts. I've seen this work with Sonoma through multiple upgrades.