Unaffiliated Remote Management Requirement on MacBook Pro after Ventura Upgrade
I attempted a clean-install of Ventura on my 2019 MacBook Pro (Intel chip) which was purchased by my company from Apple in 2020. It is a genuinely-purchased machine, not refurbished, and until now I had full admin privileges. Before the clean-install, I was running Monterey with my organization's DEP enrollment profile configured.
Much to my surprise, after the Ventura clean-install I was blocked from completing the user setup by the "Remote Management Requirement" step which pointed to an organization completely unaffiliated to my company.
- Since I naturally could not provide the organization's credentials, I removed Ventura and installed Catalina via Internet Recovery Mode. I was able to successfully setup an admin user setup by removing all network connections so that the RMR step could be bypassed (an option unavailable under Ventura). Additionally, I made sure all sharing options for the admin user were removed including Remote Management:
- Once again, I was blocked from completing the Ventura user setup by the same RMR. I assume I can update Catalina directly to Ventura within my working boot volume, but after this experience I am less interested in actually upgrading to Ventura and more concerned as to why and how a foreign DEP enrollment configuration was installed on my system (and how I can remove it!).
- To investigate further, I thought it might be possible to manually remove the DEP enrollment profile via the Catalina admin user. At first, it appeared as though there were no profiles configured:
BrutalBlondie~$ sudo profiles list
There are no configuration profiles installed in the system domain
- However, trying a more sophisticated check I located the rouge profile which is written as non-removable (see additional text, organization information redacted for their privacy):
- I tried numerous attempts (see below links) to remove the profile to no avail always getting errors that I did not have the necessary permissions.
- https://apple.stackexchange.com/questions/351892/removing-configuration-profiles-via-command-line
- https://apple.stackexchange.com/questions/351892/removing-configuration-profiles-via-command-line
- https://docs.jamf.com/10.28.0/jamf-pro/administrator-guide/MDM-Enabled_Local_User_Accounts.html
- https://community.jamf.com/t5/jamf-pro/command-line-to-remove-the-dep-setup/m-p/129895
- https://www.reddit.com/r/mac/comments/pi9beh/bypass_remote_management_on_macbook_pro_after/
- At my wits-end, I actually called the organization in question as a hail-Mary and asked if it was possible that my machine was once under their system management. Their IT department was incredibly helpful and confirmed that my MacBook's serial number was never registered as one of their machines. To add another layer of mystery, they did find a serial number registered that was only 1 letter off from my own (a 'v' vs. a 'w'). I searched both serial numbers in the Mac registry database and confirmed both numbers are indeed real and different machines. This led us to wonder if there might be a bug in the serial read-in that causes RMR to point to the wrong DEP enrollment profile during clean-install user setup.
To summarize, my main questions are:
- Why did a clean-install of Ventura result in the presence of a foreign Remote Management Requirement which prohibits any new user setup when connected to a network?
- How was a foreign organization's DEP enrollment profile installed on my machine without my or my organization's consent or knowledge?
- Is it possible to remove the profile without having access to the organizations credentials?
- Could the similarity in serial numbers between my machine and the foreign organization's machine be related to this issue?
- What greater security concerns does this experience imply for the future safety of my machine and the Ventura upgrade in general?
Any solutions or ideas are extremely appreciated!
(Thank you for getting through my rant if you made it this far ^_^)
MacBook Pro (2017 – 2020)
