Skip to main content
Solved

Mac Re Enrollment Issue

  • January 13, 2023
  • 4 replies
  • 132 views
M
Forum|alt.badge.img+3

I had a Mac that lost its connection with JAMF. I ran the following command on the machine, sudo Jamf enroll -prompt, and the machine started reporting into JAMF. The issue is that it will not push down any new Configuration Profiles and the "Management Commands" option is missing. I have tried to run the following commands to see if I could resolve any of these issues but nothing helped.

sudo jamf -removeFramework
sudo jamf reenroll -prompt
sudo profiles renew -type enrollment

I also tried to do a manual enrollment but since the old "MDM Profile" is still on the machine it will not install a new one and I can't remove the old "MDM Profile" since it was enrolled with DEP. 

Is the only option I have is wipe the device?

Best answer by junjishimazaki

I used this method to remove a non-removable MDM. This requires to be hands on the machine and booting the recovery mode and disabling SIP.

 

  1. Boot the Mac to Recovery Mode. If the mac is filevault enabled, then either have the user log In or have another user account that is able to bypass the login in the recovery mode. 
  2. Open the Terminal application from utility menu
  3. In Terminal, run csrutil disable to disable System Integrity Protection
  4. Restart the Mac into Recovery Mode again
  5. Open Disk Utility, right click on Macintosh HD, and mount the disk. If the disk is FileVault-protected, you will need to select a FV-enabled account and unlock the disk with the password.
  6. Open Terminal, and navigate to Volumes: cd /Volumes
  7. Run ls to display the list of drives. By default it would be labeled Macintosh HD
  8. Navigate into the drive with cd Macintosh\\ HD
  9. Navigate to the ConfigurationProfiles folder with cd var/db/ConfigurationProfiles
  10. Run pwd to confirm that you are in the directory /Volumes/Macintosh HD/var/db/ConfigurationProfiles
  11. Run rm -rf * to delete all files and folders in ConfigurationProfiles
  12. Run mkdir Settings to re-create the required Settings folder
  13. Run touch Settings/.profilesAreInstalled to re-create the required file
  14. Run csrutil enable to re-enable System Integrity Protection
  15. Reboot to the user’s desktop
  16. Open Terminal and run sudo profiles renew -type enrollment

You can either run the above to enroll or user-initiate enroll.

    4 replies

    sdagley
    Forum|alt.badge.img+25
    • sdagley
    • Jamf Heroes
    • 3567 replies
    • January 13, 2023

    @Mwhitten Wipe it

    junjishimazaki
    Forum|alt.badge.img+10
    • junjishimazaki
    • New Contributor
    • 423 replies
    • Answer
    • January 13, 2023

    I used this method to remove a non-removable MDM. This requires to be hands on the machine and booting the recovery mode and disabling SIP.

     

    1. Boot the Mac to Recovery Mode. If the mac is filevault enabled, then either have the user log In or have another user account that is able to bypass the login in the recovery mode. 
    2. Open the Terminal application from utility menu
    3. In Terminal, run csrutil disable to disable System Integrity Protection
    4. Restart the Mac into Recovery Mode again
    5. Open Disk Utility, right click on Macintosh HD, and mount the disk. If the disk is FileVault-protected, you will need to select a FV-enabled account and unlock the disk with the password.
    6. Open Terminal, and navigate to Volumes: cd /Volumes
    7. Run ls to display the list of drives. By default it would be labeled Macintosh HD
    8. Navigate into the drive with cd Macintosh\\ HD
    9. Navigate to the ConfigurationProfiles folder with cd var/db/ConfigurationProfiles
    10. Run pwd to confirm that you are in the directory /Volumes/Macintosh HD/var/db/ConfigurationProfiles
    11. Run rm -rf * to delete all files and folders in ConfigurationProfiles
    12. Run mkdir Settings to re-create the required Settings folder
    13. Run touch Settings/.profilesAreInstalled to re-create the required file
    14. Run csrutil enable to re-enable System Integrity Protection
    15. Reboot to the user’s desktop
    16. Open Terminal and run sudo profiles renew -type enrollment

    You can either run the above to enroll or user-initiate enroll.

    J
    Forum|alt.badge.img+3
    • jules1987
    • New Contributor
    • 9 replies
    • March 1, 2023

    Thanks a megaton. 🤗

    M
    Forum|alt.badge.img
    • melih_sancar
    • New Contributor
    • 1 reply
    • December 6, 2023

    This method fails on step 9. "cd: var: No such file or directory" message appears.

    Navigating to the /var/db/ConfigurationProfiles and following the other steps also not working. 


    Terms & ConditionsCookie settingsAccessibility statement