Turning off Device Enrollment Notifications on MacBook Pro
I have purchased a MacBook Pro a year ago and after upgrading to Sierra started to receive notifications from a company that owned a laptop before. I have tried contacting Apple Service and the actual company, no luck so far. I have learned that I need to find two files:
/System/Library/LaunchAgents/com.apple.ManagedClientAgent.enrollagent.plist
/System/Library/LaunchDaemons/com.apple.ManagedClient.enroll.plist
But I can't move them (and even create folders where they can be moved):
/Library/LaunchAgentsDisabled and /Library/LaunchDaemonsDisabled
Can anyone please help how I can turn off device enrollment notifications?
Solution 1:
I found an easy solution to get rid of the notification that worked in my case (not sure if it'll work in every case) and that didn't required to disable SIP nor go into recovery was (I'm in Big Sur v11.5):
First, block your Mac from reaching the domain iprofiles.apple.com. I use LittleSnitch as my firewall, so I blocked it there, but you can also use your hosts file like:
sudo echo "0.0.0.0 iprofiles.apple.com" >> /etc/hosts
Then, I checked the current enrollment profile
sudo profiles show -type enrollment
This will show you the current enrollment configuration your Mac has, you can even block the domain mentioned in ConfigurationURL just to be safe.
After than, I proceed to delete the profile, in my regular session, not recovery, although it would probably also work in recovery:
sudo profiles remove -all
Keep in mind that this command will delete all other profiles you may have, in my case, I didn't more.
Finally, you can check for the enrollment profile again, I would get an error saying that it could not retrieved given that I blocked the domain from where it's retrieved:
sudo profiles show -type enrollment
Error fetching Device Enrollment configuration: (34000) Error Domain=MCCloudConfigurationErrorDomain Code=34000 "The device failed to request configuration from the cloud." UserInfo={NSLocalizedDescription=The device failed to request configuration from the cloud., CloudConfigurationErrorType=CloudConfigurationFatalError}
And the notification is gone for good. I'll report back in the next OS upgrade to see if it comes back.
Solution 2:
Just in case you're still confused about this issue, restart your mac in recovery mode, in terminal, type in command:
csrutil disable; reboot
This will disable system integrity protection and restart your mac.
Open your terminal again, type in command:
sudo mv /System/Library/LaunchAgents/com.apple.ManagedClientAgent.enrollagent.plist /Library/LaunchAgentsDisabled
sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.enroll.plist /Library/LaunchDaemonsDisabled
This should do the trick.
However, don't for get to re-enable your system integrity protection by restarting your mac in recovery mode, typing in command:
csrutil enable
You can check your SIP status with command:
csrutil status
Good luck!
Solution 3:
On Big Sur, these solutions become problematic because disabling SSV (Signed System Volume) will prevent useful features, such as FileVault, from working.
Instead, I believe that you can prevent the ManagedClientAgent from being "helpful" by simply creating the file:
/var/db/ConfigurationProfiles/Settings/.cloudConfigProfileInstalled
e.g. disable SIP then
sudo touch /var/db/ConfigurationProfiles/Settings/.cloudConfigProfileInstalled
Solution 4:
This works for macOS Big Sur to Disable MDM notifications
- Restart in Recovery Mode Restart your Mac then hold down the Command & R keys together until you're in the Recovery Mode menu (Command+R)
- Click on Utilities (top menu bar) then select: Startup Security Utility
- A 3-choices popup appears: select (No security) (there is no confirmation button to press)
- Restart again in Recovery Mode (Command+R)
- Click on Utilities (top menu bar) then select Terminal
- type in:
mountthen press enter/return - A list of things will show up once you enter in (mount) in Terminal
Write down the disk associated with /Volumes/Macintosh HD
(mine was /dev/disk2s5)
Note: it's not
/, and it's not/Volumes/Macintosh HD - Data - Next, in Terminal, write:
umount /Volumes/Macintosh\ HD - then:
mkdir /Volumes/Macintosh\ HD - then:
mount -t apfs -rw /dev/disk2s5 /Volumes/Macintosh\ HD - then:
cd /Volumes/Macintosh\ HD/System/Library/LaunchAgents - then:
mkdir xtemp - then:
mv com.apple.ManagedClientAgent.* xtemp/ - then:
mv com.apple.mdmclient.* xtemp/ - then:
cd ../LaunchDaemons - then:
mkdir xtemp - then:
mv com.apple.ManagedClient.* xtemp/ - then:
mv com.apple.mdmclient.* xtemp/ - then:
csrutil authenticated-root disable (this will Turn off Signed System Volume SSV) - then lastly:
bless --folder /Volumes/Macintosh\ HD/System/Library/CoreServices --bootefi --create-snapshot(this will Save the current disk status in the boot snapshot) - Now you can restart your Mac, DEP notification is disabled.