Kids factory resetting our ipads

[mgastri]

Hey guys -

We are a public library and have a bunch of kids ipads out there loaded with educational games. The problem is a few of the more enterprising ones have found their way into the settings and unmanaged our ipads...then allowing them to do a full factory reset afterwards and get access to everything.

I'd love to be able to block access to the settings entirely or at least block them from making major changes like this. I have checked our configuration profile but don't see anything about this.

Is there anything we can do to stop them from unmanaging the ipad?

[larry_barrett]

You can prevent this using a Configuration Profile with Restrictions, however, you must have the right options selected in your Prestage Enrollment.

If you do not have the right options in Prestage, you'll have to wipe it so it gets into the new prestage.

That should be enough to prevent the unmanaging portion, then prevent access to the other command through the config profile w/restrictions

TLDR: Make sure the prestage doesn't allow for unenrollment and restrict access to the Erase all Content and Settings via Config Profile

[thejenbot]

You can also restrict Erase All Content And Settings with a configuration profile. We do that and the worst they can do is reset all settings or reset network settings...

[nicholasmcdonal]

Hi @mgastri ,

to echo @larry_barrett 's comment, make sure your Pre-Stage enrollment is making the MDM Profile Enrollment mandatory, and also ensure that you have "Prevent un-enrollment" selected.

Additionally, if these iPad devices are not in your Apple Business Manager/Apple School Manager instance you can add them as DEP enabled devices using this workflow via Apple Configurator [https://www.jamf.com/jamf-nation/articles/529/knowledge-base-video-adding-ios-devices-to-dep-with-apple-configurator-2-5]https://www.jamf.com/jamf-nation/articles/529/knowledge-base-video-adding-ios-devices-to-dep-with-apple-configurator-2-5)

• Please note the enrollment into ASM/ABM is provisional for 30 days after you complete this process (meaning the MDM profile can still be removed until 30 days has passed).