Disable Device Enrollment Program (DEP) notification on macOS Monterey.md

Disable Device Enrollment Program (DEP) notification on macOS Monterey.md

NB! command-R is replaced with holding the power button on M1 macs.

With full reinstall (recommended)

   a. Boot into recovery using command-R during reboot, wipe the harddrive using Disk Utility, and select reinstall macOS

   b. Initial installation will run for approximately 1 hour, and reboot once

   c. It will then show a remaining time of about 10-15 minutes

   d. When it reboots again, be sure to press command-R to boot into recovery and continue with Main procedure

Without full reinstall

Boot to Recovery Mode by holding command-R during restart and continue with Main procedure

Main procedure

1. Open Utilities → Terminal and type

$ csrutil disable
$ reboot

2. Hold command-R during the reboot to enter Recovery Mode again

3. Enter Disk Utility, and mount the Macintosh HD volume (or whatever your main volume is named). (It might already be mounted.)

4. Exit Disk Utility, open Utilities → Terminal, and type

$ cd "/Volumes/Macintosh HD/System/Library"
$ cd ../../etc
$ echo "0.0.0.0 iprofiles.apple.com" >> hosts
$ echo "0.0.0.0 mdmenrollment.apple.com" >> hosts
$ echo "0.0.0.0 deviceenrollment.apple.com" >> hosts
$ echo "0.0.0.0 gdmf.apple.com" >> hosts
$ csrutil enable
$ reboot

5. If you come to the “Choose your country/location” dialogue, make sure to not select a wireless network, but “continue without an internet connection”

6. After a normal boot, you can verify the DEP status in Terminal:

$ profiles status -type enrollment
Enrolled via DEP: No
MDM enrollment: No

Ok so I tried to update straight from 13.7 to 15 in software update but it failed then update showed up Sonoma (14.7)

so I made sure my hosts were set blocking the usual suspects

went into my router (lynksis) and opened up parental controls found my mac in devices and blocked access to the same as hosts file.

then just updated to sonoma took a while but at went ok mac is working as normal no MDM or difference to previous.

Now the update to 15 has showed up in update so I've now installed the update to 15 no issues at all no MDM pop ups everything seems to be working as it should , Hosts file remains unchanged still blocking as it should.

TLDR; I just made sure my hosts file and router was blocking deviceenrollment.apple.com, mdmenrollment.apple.com, iprofiles.apple.com and just updated as normal. 13 - 14 - 15

thanks.

Hi everyone !

It's about to complete a year since I followed @joshworksit's bypass. M1 Pro 2021.

Since then I have always updated without problems.

I just updated (09/25/2024) from 14.6.1 to Sequoia 15.0.

Make sure to have it configured.

echo "0.0.0.0 deviceenrollment.apple.com" >>/Volumes/Macintosh\ HD/etc/hosts
echo "0.0.0.0 mdmenrollment.apple.com" >>/Volumes/Macintosh\ HD/etc/hosts
echo "0.0.0.0 iprofiles.apple.com" >>/Volumes/Macintosh\ HD/etc/hosts

I've been on Ventura, currently 13.6.9 M1 2020. After following the guide as well. For every update, I was able to just run this command
rm -r /private/var/db/ConfigurationProfiles
I wouldn't see the nagging pop-up anymore. Until the last update and I can't remove it anymore. Restricted access etc...

Can I still update to 15 without an issue? I've been hesitant for far to long if anyone can clarify what might happen??
Thank you!

If you don't want to toss or encounter difficulties, you can ask me for a paid solution, whether it's a command line or an automatic program.

Has anyone updated to MacOs Sequoia 15.0.1? I've been looking for a permanent solution for days to end this remote management blockage once and for all and not worry about future updates but I can't find it anywhere.

Hello, thanks to all of you with the detailed instructions to upgrade the system.

I managed to upgrade the system, but now after usage for about 1-2 hours, started getting those MDM profile notifications. How do I completely avoid such profile notifications, as the system is not letting me do anything unless I enrol.

Please suggest

Hi, I tried everything, but I only came to two conclusions.
Contact the company and ask them to unlink the Mac's serial number from their system, or hire a good Indian guy that I found on Telegram to resolve it for me, which is what I did lol.
Here is the link to the video that made me find it.
https://youtu.be/XIk-GWb4K_Q?si=FumfZpFsFCEFx6mS

Another one... anyone updated from MDM ventura (13.7) to 15? (2021 MBP M1)
Thanks

I have the same questions. Used my instructions here on ventura but would like to migrate to 15. https://gist.github.com/henrik242/65d26a7deca30bdb9828e183809690bd?permalink_comment_id=4620471#gistcomment-4620471

My upgrade went smooth. Only thing I did preemptively in addition to my own instructions from the OG install is add the blacklist to the hosts file.

Hi, how can I get around this page without reinstalling macos and losing my data?
I have version 14.6

and how can I transfer my data without losing it?

Hi, how can I get around this page without reinstalling macos and losing my data? I have version 14.6

and how can I transfer my data without losing it?

Hey, i have encountered the same thing after updating my mac to sequoia. I was able to get around this page by booting the mac into recovery mode and open terminal and execute this command below, thanks to (holyMolyTolli) and everyone else who shared this

echo "0.0.0.0 deviceenrollment.apple.com" >>/Volumes/Macintosh\ HD/etc/hosts
echo "0.0.0.0 mdmenrollment.apple.com" >>/Volumes/Macintosh\ HD/etc/hosts
echo "0.0.0.0 iprofiles.apple.com" >>/Volumes/Macintosh\ HD/etc/hosts

Hello! I am a Macbook Pro M1 2020 user, I bought it in 2022, I used one of the commands that were placed in that year and so far it has not given me any problems and I can update it normally. But I am noticing my macbook is slow, I have never given it maintenance so I want to factory reset it. If I reset it, can the mdm profile be reactivated?

Hello! I am a Macbook Pro M1 2020 user, I bought it in 2022, I used one of the commands that were placed in that year and so far it has not given me any problems and I can update it normally. But I am noticing my macbook is slow, I have never given it maintenance so I want to factory reset it. If I reset it, can the mdm profile be reactivated?

Yes, it will be reactivated. The only way I found for factory reset is to install fresh big sur, apply the commands for deactivate mdm and then updating os versions.

@joshworksit Can you help me? I used your command and still getting this error message

Hello! I am a Macbook Pro M1 2020 user, I bought it in 2022, I used one of the commands that were placed in that year and so far it has not given me any problems and I can update it normally. But I am noticing my macbook is slow, I have never given it maintenance so I want to factory reset it. If I reset it, can the mdm profile be reactivated?

Yes, it will be reactivated. The only way I found for factory reset is to install fresh big sur, apply the commands for deactivate mdm and then updating os versions.

Hey bro, I have a MacBook Pro M1 2020 that's already bypassed, and I'm running Sequoia 15. If I update it, will it get the MDM lock again?

Hello! I am a Macbook Pro M1 2020 user, I bought it in 2022, I used one of the commands that were placed in that year and so far it has not given me any problems and I can update it normally. But I am noticing my macbook is slow, I have never given it maintenance so I want to factory reset it. If I reset it, can the mdm profile be reactivated?

Yes, it will be reactivated. The only way I found for factory reset is to install fresh big sur, apply the commands for deactivate mdm and then updating os versions.

Hey bro, I have a MacBook Pro M1 2020 that's already bypassed, and I'm running Sequoia 15. If I update it, will it get the MDM lock again?

No, you won't. It might be a good idea to read the release notes of new macOS updates. As far as I can tell, the hosts file, Apple are not allowed to overwrite it.

This worked really well!
Thank you so much!

Any idea on how to go about this one?

Any idea on how to go about this one?

I know a solution only for M1, what processor do you have?

I was able to fix this by installing macOS Monterey, and I had the option to proceed without that issue. I am currently running a MacBook Pro with an Apple M1 Pro chip.

**** WORKING!!! ******. HI EVERYONE! I have a simplified way I figured out today to bypass DEP today with Ventura against a M2 Macbook Air
Need 3 things

1. A separate M1/M2 Mac (could be anytjhing, macbook, studio, etc). this machine must not have DEP/Business Manager enabled
2. Create a USB Boot installer flash drive with Ventura - you can google the instructions on how to create a boot usb drive.
3. An external SSD that you can install a fresh OS on. I just use a sandish extreme USB 3.1 256GB drive.

Steps I did On the non-DEP M1/M2 Mac

1. USB BOOT installer and install Ventura on the External SSD --- using the non-DEP Mac
2. Once installed, go thru the account creation so you have an account
3. Boot from USB SSD drive just to make sure it is working.

Now you have a bootable external disk.
On the DEP enabled M1/M2 Mac

1. Boot to recovery mode
2. Disk Utility
3. Erase the internal physical disk
4. Click on internal disk and use the RESTORE option, FROM the external SSD
5. Let it run - will take a while.

Now you jsut copied the clean ventura to the internal drive.
Once the restore is finished. Remove the External SSD Boot from the internal disk
You WILL get an error that it cannot find the OS or some other stupid errors like no owner, or some other silly error... don't worry.
Now you boot again using the USB BOOT Ventura disk. REINSTALL Ventura again on the internal disk - DO NOT DO ANY DISK FORMATTING this time.
Once USB Installer is done, reboot - you will get to the login prompt of the user you created on the initial fresh install. you will have a working Ventura M1/M2 that just bypassed DEP/Business Manager.
Why this works? Because you first lay down the image on internal disk but due to some apple security, it will never boot unless you "fresh install" it. But the good things about fresh installs, Apple doesn't really wipe the system, it just lays whatever that is necessary for the OS. This means it will fix the ownership of the disks, do whatever it does but won't overwrite local accounts etc. so you will not get prompted for DEP enrollment. I don't know the actual internal details but I just know this works.
Enjoy. took me a while to figure this out after trying many things.
I do not need to do any /etc/hosts hacks, csrutil, etc. nothing. It's pretty simple to do but it does require a double install but it's easier than editing files.
You could in theory transfer a fully working Mac to another Mac now but I don't need to do that so I did the clean Ventura Install.
Now I can use this method to clean/wipe any DEP enabled machine and have myself a "pre-built" machine with certain things like chrome etc already installed. I can just boot from the external SSD periodically to get new updates of OS and software and continue to use it on any new Macs I wipe.

How to Bypass Activation Lock on Mac:

5/14/23 - another successful bypass of DEP on M1 2020 MacBook Air with Ventura (credit goes to @maclover696 👏👏👏)

Here is an updated version that works (modified steps to erase internal physical drive, which forces device restart into Activation screen):

Pre-requirements:

• Mac with Activation Lock
• Unlocked Mac laptop or desktop (e.g., M1, M2, Pro, Mini, Studio, etc.) - not enrolled in Device Enrollment Program (DEP) / Mobile Device Management (MDM)
• USB Flash Drive (14GB+ USB3.x/USB-C/Thunderbolt) - To create a USB Boot installer for macOS
• External SSD (50GB+ USB3.x/USB-C/Thunderbolt) - To install and boot from external drive

Step by step instructions on:

Unlocked Mac

1. Create a bootable installer with macOS Ventura on USB Flash Drive, see instructions at https://support.apple.com/en-us/HT201372
2. Restart and boot from USB Flash Drive with macOS Ventura
3. Install macOS Ventura on the External SSD
4. Finish installation and create a user account
5. Boot from External SSD to make sure it is working

Congrats 🎉🎉🎉 now you have a bootable external SSD

Mac with Activation Lock*

1. Boot into Recovery mode, see instructions at https://support.apple.com/en-us/HT201255
2. Open Disk Utility > select Internal Drive (or Macintosh HD) > click Restore > select External SSD (this process will fail, nothing to worry about)
3. Erase Internal Drive (all volumes)
4. Repeat step 3 above, select Internal Drive (or Macintosh HD) > click Restore > select External SSD. Be patient, the restoration speed varies depending on the type of External SSD and connectivity - some 45-60min on Samsung 980Pro 1TB NVMe in Sabrent USB-C enclosure. (this time the operation will succeed)
5. Shut down > remove External SSD
6. Boot from Internal Drive (this process will fail, and it will restart into Recovery mode, nothing to worry about)
7. Restart and boot from USB Flash Drive with macOS Ventura
8. Connect to WiFi/LAN, macOS Ventura requires internet connection for installation (no need to block ports on your router or /etc/hosts hacks, csrutil, etc.)
9. Install macOS Ventura from USB Flash Drive to Internal Drive (this time do not erase internal drive)
10. Restart after the OS installation is complete and login with the user credentials created on External SSD installation (step 4 from unlocked Mac)

Congrats 🎉🎉🎉 you've just 🔗‍💥 bypassed DEP/Business Manager

*Depending on the state of your Mac, you may need Apple Configurator to revive / restore your Mac to bring it back to life. See instructions at https://support.apple.com/guide/apple-configurator-mac/revive-or-restore-a-mac-with-apple-silicon-apdd5f3c75ad/mac and Apple Silicon M1/M2 macOS IPSW Firmware Restore Files Database https://mrmacintosh.com/apple-silicon-m1-full-macos-restore-ipsw-firmware-files-database/ alternatively Apple Configurator will download automatically the latest version.

Will this work for Intel macs? Can this be used for Sonoma or Sequoia?

Thanks for sharing. Question. Can it be updated normally without having to do a reinstall?

…

On Tue, 27 May 2025 at 1:37 am, captaindooley ***@***.***> wrote: ***@***.**** commented on this gist. ------------------------------ **** WORKING!!! ******. HI EVERYONE! I have a simplified way I figured out today to bypass DEP today with Ventura against a M2 Macbook Air Need 3 things 1. A separate M1/M2 Mac (could be anytjhing, macbook, studio, etc). this machine must not have DEP/Business Manager enabled 2. Create a USB Boot installer flash drive with Ventura - you can google the instructions on how to create a boot usb drive. 3. An external SSD that you can install a fresh OS on. I just use a sandish extreme USB 3.1 256GB drive. Steps I did On the non-DEP M1/M2 Mac 1. USB BOOT installer and install Ventura on the External SSD --- using the non-DEP Mac 2. Once installed, go thru the account creation so you have an account 3. Boot from USB SSD drive just to make sure it is working. Now you have a bootable external disk. On the DEP enabled M1/M2 Mac 1. Boot to recovery mode 2. Disk Utility 3. Erase the internal physical disk 4. Click on internal disk and use the RESTORE option, FROM the external SSD 5. Let it run - will take a while. Now you jsut copied the clean ventura to the internal drive. Once the restore is finished. Remove the External SSD Boot from the internal disk You WILL get an error that it cannot find the OS or some other stupid errors like no owner, or some other silly error... don't worry. Now you boot again using the USB BOOT Ventura disk. REINSTALL Ventura again on the internal disk - DO NOT DO ANY DISK FORMATTING this time. Once USB Installer is done, reboot - you will get to the login prompt of the user you created on the initial fresh install. you will have a working Ventura M1/M2 that just bypassed DEP/Business Manager. Why this works? Because you first lay down the image on internal disk but due to some apple security, it will never boot unless you "fresh install" it. But the good things about fresh installs, Apple doesn't really wipe the system, it just lays whatever that is necessary for the OS. This means it will fix the ownership of the disks, do whatever it does but won't overwrite local accounts etc. so you will not get prompted for DEP enrollment. I don't know the actual internal details but I just know this works. Enjoy. took me a while to figure this out after trying many things. I do not need to do any /etc/hosts hacks, csrutil, etc. nothing. It's pretty simple to do but it does require a double install but it's easier than editing files. You could in theory transfer a fully working Mac to another Mac now but I don't need to do that so I did the clean Ventura Install. Now I can use this method to clean/wipe any DEP enabled machine and have myself a "pre-built" machine with certain things like chrome etc already installed. I can just boot from the external SSD periodically to get new updates of OS and software and continue to use it on any new Macs I wipe. How to Bypass Activation Lock on Mac: *5/14/23 - another successful bypass of DEP on M1 2020 MacBook Air with Ventura (credit goes to @maclover696 <https://github.com/maclover696> 👏👏👏)* Here is an updated version that works (modified steps to erase internal physical drive, which forces device restart into Activation screen): Pre-requirements: - Mac with Activation Lock - Unlocked Mac laptop or desktop (e.g., M1, M2, Pro, Mini, Studio, etc.) - not enrolled in Device Enrollment Program (DEP) / Mobile Device Management (MDM) - USB Flash Drive (14GB+ USB3.x/USB-C/Thunderbolt) - To create a USB Boot installer for macOS - External SSD (50GB+ USB3.x/USB-C/Thunderbolt) - To install and boot from external drive *Step by step instructions on:* *Unlocked Mac* 1. Create a bootable installer with macOS Ventura on USB Flash Drive, see instructions at https://support.apple.com/en-us/HT201372 <http://url> 2. Restart and boot from USB Flash Drive with macOS Ventura 3. Install macOS Ventura on the External SSD 4. Finish installation and create a user account 5. Boot from External SSD to make sure it is working Congrats 🎉🎉🎉 now you have a bootable external SSD *Mac with Activation Lock** 1. Boot into Recovery mode, see instructions at https://support.apple.com/en-us/HT201255 <http://url> 2. Open Disk Utility > select Internal Drive (or Macintosh HD) > click Restore > select External SSD (this process will fail, nothing to worry about) 3. Erase Internal Drive (all volumes) 4. Repeat step 3 above, select Internal Drive (or Macintosh HD) > click Restore > select External SSD. Be patient, the restoration speed varies depending on the type of External SSD and connectivity - some 45-60min on Samsung 980Pro 1TB NVMe <https://www.amazon.com/SAMSUNG-PCIe-Internal-Gaming-MZ-V8P1T0B/dp/B08GLX7TNT/> in Sabrent USB-C enclosure <https://www.amazon.com/Sabrent-Type-C-Tool-Free-Enclosure-EC-SNVE/dp/B08RVC6F9Y/>. (this time the operation will succeed) 5. Shut down > remove External SSD 6. Boot from Internal Drive (this process will fail, and it will restart into Recovery mode, nothing to worry about) 7. Restart and boot from USB Flash Drive with macOS Ventura 8. Connect to WiFi/LAN, macOS Ventura requires internet connection for installation (no need to block ports on your router or /etc/hosts hacks, csrutil, etc.) 9. Install macOS Ventura from USB Flash Drive to Internal Drive (this time do not erase internal drive) 10. Restart after the OS installation is complete and login with the user credentials created on External SSD installation (step 4 from unlocked Mac) Congrats 🎉🎉🎉 you've just 🔗‍💥 bypassed DEP/Business Manager *Depending on the state of your Mac, you may need Apple Configurator to revive / restore your Mac to bring it back to life. See instructions at https://support.apple.com/guide/apple-configurator-mac/revive-or-restore-a-mac-with-apple-silicon-apdd5f3c75ad/mac <http://url> and Apple Silicon M1/M2 macOS IPSW Firmware Restore Files Database https://mrmacintosh.com/apple-silicon-m1-full-macos-restore-ipsw-firmware-files-database/ <http://url> alternatively Apple Configurator will download automatically the latest version. Will this work for Intel macs? Can this be used for Sonoma or Sequoia? — Reply to this email directly, view it on GitHub <https://gist.github.com/henrik242/65d26a7deca30bdb9828e183809690bd#gistcomment-5593523> or unsubscribe <https://github.com/notifications/unsubscribe-auth/A7LNH27T7SPSHNRA7MAKBEL3AMYJ7BFKMF2HI4TJMJ2XIZLTSKBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DFVRZXKYTKMVRXIX3UPFYGLK2HNFZXIQ3PNVWWK3TUUZ2G64DJMNZZDAVEOR4XAZNEM5UXG5FFOZQWY5LFVEYTAMBRGYYTCMRSU52HE2LHM5SXFJTDOJSWC5DF> . You are receiving this email because you commented on the thread. Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub> .

Updated recently to macos sequoia, so far no issues.

Updated recently to macos sequoia, so far no issues.

Can you please let us know? Which version are you using? like 14.1.1 etc.

Throwing this one out for the homies

I recently helped out an old lady who got a second-hand computer from her grandkid and it had an MDM profile / DEP screen that stole the mouse and keyboard input. I did not wipe the machine or reinstall macOS. I used recovery mode + root account. Machine was an M1 MacBook Air running the 14.7.8 that was hard stuck at DEP enrollment (would lock you out after 10 seconds). If you want to run the script at the end, you will need to leave csrutil disabled (which I disabled as part of this exercise). Otherwise, after you validated you are back in and working, just enable it again and reboot.

⸻

Recovery Mode

##################################################################################`
# RECOVERY: unlock the Data volume, clear ADE/MDM state, block Apple endpoints,
# sync Preboot (important with FileVault), then reboot. Make sure to note diskXsY.
##################################################################################

# 1) Identify and unlock the FileVault Data (Macintosh HD - DATA) volume
diskutil apfs list
diskutil apfs unlockVolume diskXsY -passphrase "YOUR_FILEVAULT_PASSWORD"

# 2) Flip ADE state on the Data volume:
cd "/Volumes/Macintosh HD - Data/var/db/ConfigurationProfiles/Settings"

rm -rf ./.*
rm -rf ./*

touch .cloudConfigProfileInstalled
touch .cloudConfigRecordNotFound

# 3) Remove any already-installed MDM profiles from the local store (Sequoia stores them in Store/).
cd "/Volumes/Macintosh HD - Data/var/db/ConfigurationProfiles/Store"

rm -rf ./.*
rm -rf /*

# 4) Ensure Setup Assistant won’t rerun
touch "/Volumes/Macintosh HD - Data/var/db/.AppleSetupDone"

# 5) Block Apple Automated Device Enrollment endpoints
echo "0.0.0.0 deviceenrollment.apple.com" >> "/Volumes/Macintosh HD - Data/etc/hosts"
echo "0.0.0.0 mdmenrollment.apple.com"   >> "/Volumes/Macintosh HD - Data/etc/hosts"
echo "0.0.0.0 iprofiles.apple.com"       >> "/Volumes/Macintosh HD - Data/etc/hosts"

# 6) Sync Preboot with updated Data volume
diskutil apfs updatePreboot diskXsY

# 7) Reboot
reboot

⸻

Normal macOS (not recovery)

################################################################################
# NORMAL macOS: disable enrollment daemons/agents so they can’t reassert nag state
################################################################################

# 1) Disable and stop system daemons
sudo launchctl disable system/com.apple.ManagedClient.cloudconfigurationd
sudo launchctl bootout  system/com.apple.ManagedClient.cloudconfigurationd 2>/dev/null || true

sudo launchctl disable system/com.apple.ManagedClient.daemon
sudo launchctl bootout  system/com.apple.ManagedClient.daemon 2>/dev/null || true

# Present on some builds; safe even if absent
sudo launchctl disable system/com.apple.ManagedClient.enroll 2>/dev/null || true
sudo launchctl bootout  system/com.apple.ManagedClient.enroll 2>/dev/null || true

# 2) Disable and stop per-user agents
for uid in $(dscl . -list /Users UniqueID | awk '$2>=501 {print $2}'); do
  sudo launchctl disable gui/$uid/com.apple.ManagedClientAgent.enrollagent 2>/dev/null || true
  sudo launchctl bootout  gui/$uid/com.apple.ManagedClientAgent.enrollagent 2>/dev/null || true
  sudo launchctl disable user/$uid/com.apple.ManagedClientAgent.enrollagent 2>/dev/null || true
  sudo launchctl bootout  user/$uid/com.apple.ManagedClientAgent.enrollagent 2>/dev/null || true
done

# 3) Quick checks
csrutil status
sudo profiles show -type enrollment
grep -E 'deviceenrollment|mdmenrollment|iprofiles' /etc/hosts
ls -al /var/db/ConfigurationProfiles/Settings

⸻

One-time setup script:

# =====================================================================
# ONE-TIME SETUP Script baby
# =====================================================================

# 0) Root-owned place for the script
sudo mkdir -p /usr/local/sbin
sudo chown root:wheel /usr/local/sbin
sudo chmod 755 /usr/local/sbin

# 1) Create the enforcement script (no deletes; only disable + add/ensure)
sudo tee /usr/local/sbin/mdm_enforce.sh >/dev/null <<'SH'
#!/bin/sh
set -e

SETTINGS="/var/db/ConfigurationProfiles/Settings"
HOSTS="/etc/hosts"

# ---------- A) Disable/stop ManagedClient daemons (system) ----------
launchctl disable system/com.apple.ManagedClient.cloudconfigurationd 2>/dev/null || true
launchctl bootout  system/com.apple.ManagedClient.cloudconfigurationd 2>/dev/null || true
launchctl disable system/com.apple.ManagedClient.daemon 2>/dev/null || true
launchctl bootout  system/com.apple.ManagedClient.daemon 2>/dev/null || true
launchctl disable system/com.apple.ManagedClient.enroll 2>/dev/null || true
launchctl bootout  system/com.apple.ManagedClient.enroll 2>/dev/null || true

# ---------- B) Disable/stop agents for ALL real user IDs ----------
# (covers both gui/UID and user/UID; safe no-ops if not present)
USER_IDS=$(/usr/bin/dscl . -list /Users UniqueID 2>/dev/null | /usr/bin/awk '$2>=501 {print $2}')
for USER_ID in $USER_IDS; do
  launchctl disable "gui/${USER_ID}/com.apple.ManagedClientAgent.enrollagent" 2>/dev/null || true
  launchctl bootout  "gui/${USER_ID}/com.apple.ManagedClientAgent.enrollagent" 2>/dev/null || true
  launchctl disable "user/${USER_ID}/com.apple.ManagedClientAgent.enrollagent" 2>/dev/null || true
  launchctl bootout  "user/${USER_ID}/com.apple.ManagedClientAgent.enrollagent" 2>/dev/null || true
done

# ---------- C) Ensure spoof flags exist (no removal) ----------
/bin/mkdir -p "${SETTINGS}"
/usr/bin/touch "${SETTINGS}/.cloudConfigProfileInstalled"
/usr/bin/touch "${SETTINGS}/.cloudConfigRecordNotFound"

# ---------- D) Keep Setup Assistant marked complete ----------
/usr/bin/touch /var/db/.AppleSetupDone

# ---------- E) Ensure ADE endpoints are blocked (idempotent) ----------
/usr/bin/grep -q 'deviceenrollment.apple.com' "${HOSTS}" || echo "0.0.0.0 deviceenrollment.apple.com" >> "${HOSTS}"
/usr/bin/grep -q 'mdmenrollment.apple.com'   "${HOSTS}" || echo "0.0.0.0 mdmenrollment.apple.com"   >> "${HOSTS}"
/usr/bin/grep -q 'iprofiles.apple.com'       "${HOSTS}" || echo "0.0.0.0 iprofiles.apple.com"       >> "${HOSTS}"

exit 0
SH

sudo chmod 755 /usr/local/sbin/mdm_enforce.sh
sudo chown root:wheel /usr/local/sbin/mdm_enforce.sh

⸻

LaunchDaemon to auto-run:

sudo tee /Library/LaunchDaemons/com.local.mdm_enforce.plist >/dev/null <<'PLIST'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
 "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>com.local.mdm_enforce</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/local/sbin/mdm_enforce.sh</string>
  </array>
  <key>RunAtLoad</key>
  <true/>
  <key>StartInterval</key>
  <integer>900</integer>
  <key>StandardOutPath</key>
  <string>/var/log/mdm_enforce.log</string>
  <key>StandardErrorPath</key>
  <string>/var/log/mdm_enforce.log</string>
</dict>
</plist>
PLIST

sudo chown root:wheel /Library/LaunchDaemons/com.local.mdm_enforce.plist
sudo chmod 644 /Library/LaunchDaemons/com.local.mdm_enforce.plist

# load and kickstart it right away
sudo launchctl bootstrap system /Library/LaunchDaemons/com.local.mdm_enforce.plist
sudo launchctl enable system/com.local.mdm_enforce
sudo launchctl kickstart -k system/com.local.mdm_enforce

Careful with those rm -rf ./.* rm -rf ./* rm -rf /* commands, they look like they might delete more than you are expecting. I'm talking Especially about that last one. There's a typo.

rm -rf ./.*
rm -rf /*

Is there anyway to install MacOS without Internet access after erasing the volume?

anyone able to upgrade to Macos Tahoe from the AppStore?

anyone able to upgrade to Macos Tahoe from the AppStore?

Waiting for the same question as well.

I just tried it on my test MacBook Pro, and the enrolment message popped up.

I just tried it on my test MacBook Pro, and the enrolment message popped up.

Can you still use the device if you get the enrol message?

Works fine without any problem , you may need to install old macos then do the process i also prefer to do mount -uw / to remov ethe read only on hosts file