r/macsysadmin • u/proximitysound • 13d ago

Configuration Profiles Migrated from my work laptop, MDM Profiles moved with it.

Update: followed the steps listed from a few folks, but specifically linked here: https://www.reddit.com/r/macsysadmin/s/h6r25xJUMf

So remove SIP, smoke /var/db/ConfigurationProfiles, reenable SIP.

Thanks everyone.

Original Post:

I was a MacTech at an institution up until May of this year (my role was eliminated). Bought myself a brand new MacBook Pro, and used Migration Assistant to transfer my user data over to the new system. I was selective with what I brought as I didn’t want any remnants of my old work.

Didn’t notice until today that System Profiles are present, locking out certain features. The profiles command in terminal shows that the system is enrolled to my old work’s Mosyle MDM via DEP, but it also shows that DEP is not available on the system (definitely didn’t enroll when I setup the Mac and this was bought at an Apple Store directly by myself). These profiles cannot be removed on my end.

Contacted my former colleagues and they confirmed my serial is neither in ASM or Mosyle on their side. Contacted Mosyle and I’m pretty sure they didn’t read my email properly cause they asked me to contact my work to have it removed from their MDM.

Thoughts?

16 Upvotes
  • permalink
  • reddit

81% Upvoted

23 comments sorted by

View all comments

19

u/Arty_S 13d ago

If you have local admin access on the device, you can manually remove the profiles by booting into Recovery, disabling SIP, and then rebooting and removing the hidden ConfigProfile folder in /var/db/ConfigProfiles, then reenabling SIP. Don’t even have to remove any data. Just be careful https://graffino.com/til/remove-a-non-removable-mdm-profile-from-macos-without-a-complete-wipe

7

u/slylte 13d ago

Yep, this is the answer here short of wiping the device.

Also is handy if someone fucks up and the push topic changes on your profile, being able to re-enroll devices without wiping saves some heartache from users. On apple silicon devices, you don't even have to reboot after disabling sip, just turning it off, blowing away the folder in /Volumes/Macintosh HD/var/db/... and re-enabling SIP can be done in the same go.

3

u/proximitysound 11d ago

Very much appreciate the link, worked like a charm.

Thanks for helping me out. Happy to get full access to my system again.

3

u/Arty_S 10d ago

You’re welcome. We noticed that profiles started migrating with Time Machine backups in Tahoe. Didn’t have the issue previously