That’s not true anymore. Now if enrollment is required because the computer was bought for a company, you cannot bypass it anymore (just like for iPhones).
back
1 comments
This was not experience when I installed Sonoma on an M2 MBP a few months ago. Enrollment was easily skipped by blocking connection to the enrollment server.
I realize this may be straightforqard for an IT admin with creds, but does this hold of the avg user? How about avg engineer?
>>>>Easily skipped .....by blocking connection to enrollment server
I don't have any special MDM creds, but I do have an admin account on my OS.
Probably not the avg user or engineer (though giving engineers admin account on their local OS is common). But that's hard to predict because usually you'd want to enroll, so I don't often see people trying to avoid it. Usually it's because of a bug. In my experience if the MDM process is buggy then it's more likely to be bypassable.
Setting a firmware password and blocking boot to external drives makes it harder, but a lot of orgs don't do it.
Even a relatively non-technical user could do so.
Last instructions I saw and tested said "install Monterey with no internet connection, open terminal, sudo nano /etc/hosts, add these three entries, save, close, upgrade to Sonoma".
That fully disabled MDM/DEP on an M2 MBP. Not sure if it would periodically ping after install/upgrade, but is about as clean as it gets, and for now survives OS upgrades.
I'm wondering, does the machine only check enrollment once? What if a future OS update institutes regular checks?
It checks again unless the user cripples the service (which requires access to disable System Integrity Protection), and even if they do it will be undone after am update. But it requires the user to accept the enrollment (just a couple clicks on a pop up). I don't know that that can be changed.
During OS install the enrollment will just happen; the user's acceptance is not required.
You can zero route a few DNS entries at your router, and be fine, and then if you want, edit /etc/hosts. I've seen this work with Sonoma through multiple upgrades.