Removing MDM Profiles

Question

Level 1

21 points

Removing MDM Profiles

Hi all,

I recently bought a used Mac that I now discover is still connected to a college's IT department via MDM profiles. They can erase my Mac, lock my screen etc. I'm hoping you might be able to help me with the following questions.

If/when the college removes my Mac from their MDM system, will they ever be able to reinstall MDM profiles? They have my UUID.

Put another way, what information and/or access is required to install MDM profiles on a remote Mac over the Net? I read through the Profile Manager docs as best I could, and it appeared that all you need is the UUID or serial number. Is that correct, or am I misinformed?

I'm trying to determine whether I'll ever be able to be fully confident that this Mac is secure and under my exclusive control. What say you?

As best I can tell, there's no way for me to break the connection to the college from my end. If you know differently, please advise.

Many grateful thanks for any advice or information you can share. As it stands there's no point in setting up a Mac someone else can erase, and I can't in good conscience even sell this machine as it is. I'm truly at square zero without some help. THANKS!

Posted on Nov 20, 2016 3:41 PM

Reply

Answer 1

Nov 21, 2016 6:04 AM in response to Kate_Mac

Could it be that they have forgotten to remove it from DEP? In that case it will call home to Apple and check ownership and if the owner has an MDM registered it will check in with that every reboot or installation.

Reply

Answer 2

Kate_Mac Author

Level 1

21 points

Nov 21, 2016 1:42 PM in response to Kate_Mac

Hi theFerret, thanks for replying to my question, appreciated.

Yes, you have described the situation well. The problem is that both previous owners, a community college and the used Mac vendor they sold the Mac to, have neglected to remove this machine from the DEP. So, as you say, it calls home with every boot. There's no way to install OSX without giving the previous owner control of this machine.

I have to learn if I can ever truly secure this Mac. Even if/when the college removes me from the DEP is there anything stopping them from putting me back on at some later date? They have an MDM account with Apple, and my UUID. Is that all they need to retake control of this machine? I need a definitive authoritative answer to this so I'll know whether this can be fixed or I need to get rid of this machine.

Thanks to anybody who can help, or who can direct towards those who can. Much appreciated!

Reply

Answer 3

Kate_Mac Author

Level 1

21 points

Nov 22, 2016 6:38 AM in response to Kate_Mac

Hi again,

I found Apple's DEP Guide.

http://images.apple.com/education/docs/DEP_Guide.pdf

Here's what the DEP Guide says....

"Note: If a device is sold, lost, returned to the reseller, or damaged beyond repair, it should be permanently removed from your organization’s list of managed devices using the DEP website per the terms of the agreement. However, once a device is removed from DEP, it can’t be added back."

This is progress for sure, but the question is still not yet definitively answered.

Note how the college has already broken the rules of DEP by not removing the Mac from the DEP list prior to sale.

So when we get to the issue of adding a device back to the DEP, does Apple mean a device shouldn't be added back on the DEP list, or that it literally can not be added back?

As example, suppose I sold this Mac to another college. Could that college add this Mac to their DEP list? Or would they be unable to do so? If I had a DEP account, could I add this Mac back to the DEP list, or would the software prevent me from doing so?

Thanks for your thoughts.

Reply

Answer 4

Nov 23, 2016 6:19 AM in response to Kate_Mac

As far as I remember it can only be added when originally sold from Apple or a reseller offering DEP connection so if those who sold it to you remove it from their DEP list it can't be added again, to their or any other DEP list although it can be manually or by script be added to any MDM system (there's also a special folder that's checked every boot and if the correct data is place there it can be added that way as well). All those MDM possibilities is taken care of by doing a complete Internet recovery after they have removed it from their DEP list (it's not hard but it may take a few days or maybe a week before it's processed in Aoole's server end).

Reply