How Does a Device Get Managed? My Computer Did.

Here is the last dmesg. As you Can tell it has AppleDeviceManagement and also an actuator driver that can turn the Apple camera on remotely it seems. I have taken it in for repairs 5 times, but every time I tell them I get it back as a managed client with virtual usb, PAN bluetooth, actuator and HID Event Driver as well as a virtual mouse. There is plists from open source apple such as Corba, Microsoft, Dyngroup and others. They seem to be sticky files because even running gparted and memtest I am left with the same files when going into netboot. This has caused me the most frustrating year as my computer seems to be managed by someone else and no matter what I say to Apple they haven't fixed it. Replaced Logic Board, Hard Drive but the problem persists. Does anyone have any ideas as to how I can get it from managed to unmanaged, it seems to maybe be identity theft and theft of services and device as there are remote users on wlan0 which is an AP. The bridge0 has a static mac and ip address of 0.0.0.0 and encompasses en1 and en2. It is mobile config and when doing a search of the Settings documents it says Public Provision. I am confused as to how a computer can become publicly provisioned. There is a developers account that seems to state that it is running some sort of Puppet VMWare. This is a serious matter in terms of privacy so any thoughts please let me know.


PMAP: PCID enabled

PMAP: Supervisor Mode Execute Protection enabled

Darwin Kernel Version 14.5.0: Wed Jul 29 02:26:53 PDT 2015; root:xnu-2782.40.9~1/RELEASE_X86_64

vm_page_bootstrap: 3871937 free pages and 289599 wired pages

kext submap [0xffffff7f80a00000 - 0xffffff8000000000], kernel text [0xffffff8000200000 - 0xffffff8000a00000]

zone leak detection enabled

"vm_compressor_mode" is 4

multiq scheduler config: deep-drain 0, urgent first 1, depth limit 4, band limit 127, sanity check 0

standard timeslicing quantum is 10000 us

standard background quantum is 2500 us

mig_table_max_displ = 13

TSC Deadline Timer supported and enabled

[IOBluetoothHCIController][start] -- completed

AppleACPICPU: ProcessorId=1 LocalApicId=0 Enabled

AppleACPICPU: ProcessorId=2 LocalApicId=2 Enabled

AppleACPICPU: ProcessorId=3 LocalApicId=4 Enabled

AppleACPICPU: ProcessorId=4 LocalApicId=6 Enabled

AppleACPICPU: ProcessorId=5 LocalApicId=1 Enabled

AppleACPICPU: ProcessorId=6 LocalApicId=3 Enabled

AppleACPICPU: ProcessorId=7 LocalApicId=5 Enabled

AppleACPICPU: ProcessorId=8 LocalApicId=7 Enabled

calling mpo_policy_init for AMFI

Security policy loaded: Apple Mobile File Integrity (AMFI)

calling mpo_policy_init for Sandbox

Security policy loaded: Seatbelt sandbox policy (Sandbox)

calling mpo_policy_init for TMSafetyNet

Security policy loaded: Safety net for Time Machine (TMSafetyNet)

calling mpo_policy_init for Quarantine

Security policy loaded: Quarantine policy (Quarantine)

Copyright (c) 1982, 1986, 1989, 1991, 1993

The Regents of the University of California. All rights reserved.


MAC Framework successfully initialized

using 16384 buffer headers and 10240 cluster IO buffer headers

AppleKeyStore starting (BUILT: Jul 29 2015 02:03:38)

IOAPIC: Version 0x20 Vectors 64:87

ACPI: sleep states S3 S4 S5

pci (build 02:08:07 Jul 29 2015), flags 0xe3000, pfm64 (39 cpu) 0x7f80000000, 0x80000000

[ PCI configuration begin ]

console relocated to 0x7fa0180000

[ PCI configuration end, bridges 13, devices 15 ]

AppleThunderboltNHIType2::setupPowerSavings - notification based runtime power management

mcache: 8 CPU(s), 64 bytes CPU cache line size

mbinit: done [128 MB total pool size, (85/42) split]

com.apple.AppleFSCompressionTypeDataless kmod start

com.apple.AppleFSCompressionTypeZlib kmod start

com.apple.AppleFSCompressionTypeDataless load succeeded

com.apple.AppleFSCompressionTypeZlib load succeeded

IOHDIXController: NOTE: administrator is creating non-ejectable disk image

rooting via boot-uuid from /chosen:

Waiting on <dict ID="0"><key>IOProviderClass</key><string ID="1">IOResources</string><key>IOResourceMatch</key><string ID="2">boot-uuid-media</string></dict>

Got boot device = IOService:/IOResources/IOHDIXController/ramfile://506538147@0/KDIRAMBackingStor e/KDIUDIFEncoding/KDIUDIFDiskImage/KDIDiskImageNub/IOHDIXHDDriveInKernel/IODiskI mageBlockStorageDeviceInKernel/IOBlockStorageDriver/Apple disk image Media/IOApplePartitionScheme/disk image@2

BSD root: disk0s2, major 1, minor 2

hfs: mounted OS X Base System on device root_device

XCPM: registered

VM Swap Subsystem is ON

ARPT: 1.959841: srom rev:12

ARPT: 1.960235: ChangeVCO => vco:960, xtalF:40, frac: 98, ndivMode: 3, ndivint: 24

ARPT: 1.960242: Data written into the PLL_CNTRL_ADDR2: 00000c31

ARPT: 1.960283: Data written into the PLL_CNTRL_ADDR3 (Fractional): 0000100e

ARPT: 1.978865: BRCM tunables:

ARPT: 1.978870: pullmode[1] txringsize[ 256] txsendqsize[1024] reapmin[ 32] reapcount[ 128]

ARPT: 1.979835: wl0: Broadcom BCM43ba, vendorID[0x14e4] BAR0[0xb0800004]

7.15.166.24 (r541488)

hfs: mounted untitled on device disk2

hfs: mounted untitled on device disk3

hfs: mounted untitled on device disk4

hfs: mounted untitled on device disk5

hfs: mounted untitled on device disk6

hfs: mounted untitled on device disk7

hfs: mounted untitled on device disk8

hfs: mounted untitled on device disk9

hfs: mounted untitled on device disk10

USBMSC Identifier (non-unique): 000000000820 0x5ac 0x8406 0x820, 3

hfs: mounted untitled on device disk11

hfs: mounted untitled on device disk12

hfs: mounted untitled on device disk13

hfs: mounted untitled on device disk14

AppleDeviceManagementHIDEventService::start start could not make a string from out connection notification key

AppleDeviceManagementHIDEventService::start start could not make a string from out poweredoff notification key

AppleDeviceManagementHIDEventService::processWakeReason Wake reason: Keyboard (0x02)


[AppleMultitouchDevice::start] entered

[AppleActuatorHIDEventDriver::start] entered

BuildActDeviceEntry enter

AppleActuatorDevice::start Entered

BuildActDeviceEntry exit

AppleDeviceManagementHIDEventService::messageClientsWithBSString messageClientsWithBSString sending message USBConnected

AppleActuatorDeviceUserClient::start Entered

Unrecognized reportID 0x02

Sandbox: mDNSResponder(130) deny file-read-data /usr/sbin/mDNSResponder/..namedfork/rsrc

IOGraphics flags 0x43

AppleCamIn::init

AppleCamIn::probe

AppleCamIn::start

virtual bool AppleCamIn::start(IOService *): about to configure DDR

AppleCamIn::start - S2 DDR Frequency set to 450 MHz (default)

AGC: 3.10.25, HW version=4.0.20 [3.2.8], flags:0, features:20600

save_ddr_phy_regs: saving 127 DDR PHY shmoo-calibrated registers

**** [BroadcomBluetoothHostControllerUSBTransport][probe] -- Found IOUSBCompositeDriver -- 0x9800

**** [BroadcomBluetoothHostControllerUSBTransport][start] -- Found IOUSBCompositeDriver -- 0x9800

**** [IOBluetoothHostControllerUSBTransport][start] -- completed -- result = TRUE -- 0x9800 ****

**** [BroadcomBluetoothHostControllerUSBTransport][start] -- Completed (matched on Interface) -- 0x9800 ****

[IOBluetoothHCIController][staticBluetoothTransportShowsUp] -- Received Bluetooth Controller register service notification -- 0x9800

Previous shutdown cause: 3

IOPPF - IODeviceTree:/efi/platform/StartupPowerEvents: 0x0

hmm.. mismatch sizes: 3100 vs 20

IOPPF: XCPM mode

X86PlatformShim::sendPStates - Success!

X86PlatformShim::sendPStates - Success!

X86PlatformShim::sendPStates - Success!

X86PlatformShim::sendPStates - Success!

X86PlatformShim::sendPStates - Success!

X86PlatformShim::sendPStates - Success!

X86PlatformShim::sendPStates - Success!

X86PlatformShim::sendPStates - Success!

**** [IOBluetoothHostControllerUSBTransport][start] -- completed -- result = TRUE -- 0xb800 ****

**** [BroadcomBluetoothHostControllerUSBTransport][start] -- Completed (matched on Device) -- 0xb800 ****

[IOBluetoothHCIController][staticBluetoothTransportShowsUp] -- Received Bluetooth Controller register service notification -- 0xb800

[IOBluetoothHCIController::setConfigState] calling registerService

**** [IOBluetoothHCIController][ProcessBluetoothTransportShowsUpActionWL] -- Connected to the transport successfully -- 0x3c00 -- 0xd000 -- 0xb800 ****


DSMOS has arrived

AppleCamIn::start - link control offset in PCI bridge = 0x50

AppleCamIn::start - pmcsr offset in PCI bridge = 0xa4

AppleCamIn::power_off_hardware

AppleCamIn::initForPM

AppleCamIn::systemWakeCall - messageType = 0xE0000340

IO80211Controller::dataLinkLayerAttachComplete(): adding AppleEFINVRAM notification

IO80211Interface::efiNVRAMPublished():

bpfAttach len 64 dlt 12

AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).

en0::IO80211Interface::postMessage bssid changed

en1: promiscuous mode enable succeeded

en2: promiscuous mode enable succeeded

ARPT: 20.115098: ChangeVCO => vco:960, xtalF:40, frac: 98, ndivMode: 3, ndivint: 24

ARPT: 20.115101: Data written into the PLL_CNTRL_ADDR2: 00000c31

ARPT: 20.115115: Data written into the PLL_CNTRL_ADDR3 (Fractional): 0000100e

Sandbox: mDNSResponder(130) deny file-read-data /Applications/Safari.app

Sandbox: mDNSResponder(130) deny file-read-data /Applications/Safari.app/Contents

Sandbox: mDNSResponder(130) deny file-read-data /Applications/Safari.app/Contents/PkgInfo

Sandbox: mDNSResponder(130) deny file-read-data /Applications/Safari.app/Contents/MacOS/Safari

bpfAttach len 94 dlt 163

bpfAttach len 30 dlt 105

bpfAttach len 52 dlt 127

bpfAttach len 38 dlt 192

en0: channel changed to 1

en0: channel changed to 1

en0: channel changed to 1

en0: channel changed to 1

en0: 802.11d country code set to 'US'.

en0: Supported channels 1 2 3 4 5 6 7 8 9 10 11 12 13 36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 144 149 153 157 161 165

en0: 802.11d country code set to 'X0'.

en0: Supported channels 1 2 3 4 5 6 7 8 9 10 11 12 13 36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 144 149 153 157 161 165


Sandbox: mDNSResponder(130) deny file-read-data /Applications/Utilities/System Information.app

Sandbox: mDNSResponder(130) deny file-read-data /Applications/Utilities/System Information.app/Contents/MacOS/System Information

Sandbox: mDNSResponder(130) deny file-read-data /Applications/Utilities/Terminal.app

Sandbox: mDNSResponder(130) deny file-read-data /Applications/Utilities/Terminal.app/Contents

Sandbox: mDNSResponder(130) deny mach-lookup com.apple.coreservices.quarantine-resolver

en0: 802.11d country code set to 'US'.

en0: Supported channels 1 2 3 4 5 6 7 8 9 10 11 12 13 36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 144 149 153 157 161 165

ARPT: 24.289724: MacAuthEvent en0 Auth result for: xx:xx:xx:xx:xx MAC AUTH succeeded

AirPort: Link Up on en0

en0: BSSID changed to xx:xx:xx:xx:xx:xx

en0: channel changed to 153,80

en0::IO80211Interface::postMessage bssid changed

AirPort: RSN handshake complete on en0

en0: BSSID changed to xx:xx:xx:xx:xx:b3

en0: channel changed to 153,80

hfs: Initializing the journal (joffset 0x1d1f000 sz 0x5000000)...

hfs: mounted Untitled 1 on device disk1s2

Sandbox: iconservicesd(118) deny file-write-create /Library/Caches

considerRebuildOfPrelinkedKernel com.apple.nke.webcontentfilter triggered rebuild

MacBook Pro with Retina display, OS X El Capitan (10.11.3)

Posted on Mar 3, 2016 7:57 PM

Reply
1 reply

Dec 6, 2016 10:47 PM in response to ConfusedSFLA

N surprised there are no responses. Throughout the course of my research the past few months, every direct question from an apparently tech savvy individual about this issue has fallen on deaf ears. Yours was well worded and the ridiculousness of this being ignored prompted me to respond. Unfortunately the more I dig the more it seems like Apple must be so complicit considering the way they handle these claims. I, too, had a computer "serviced" by Apple after experiencing the exact same issues.


It seems to be hooked into every part of the operating system. It uses native processes (or at least their names) especially the ones related to X server, which only makes it more difficult to characterize and easier for others to dismiss

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

How Does a Device Get Managed? My Computer Did.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.