Self Service for macOS: Erase Assistant

[dan-snelson]

Background

Now that macOS Monterey is out, we wanted to allow our opt-in Beta Testers with local admin rights easy access to nuke-and-pave their Macs the "Apple" way:

macOS Monterey includes Erase All Content and Settings, a way to quickly and securely erase all of your settings, data, and apps, while maintaining the operating system currently installed. If your Mac includes this feature when using macOS Monterey, use it instead of other utilities to erase your Mac.

Source: HT212749

---

Smart Group

Erase Assistant

And / Or		Criteria	Operator	Value
		Operating System Version	greater than or equal	12.0.1
and	(	Architecture Type	is	arm64
or		Boot ROM	like	iBridge	)

---

Policy

Options

General

• Display Name: Erase Assistant
• Execution Frequency: Ongoing

Files and Processes

• Execute Command:

/usr/bin/su \- "/usr/bin/stat -f%Su /dev/console" -c "/usr/bin/open '/System/Library/CoreServices/Erase Assistant.app'"​

Scope

Targets

• Erase Assistant

Self Service

• Self Service Display Name: Erase All Content and Settings
• Button Name Before Initiation: Erase
• Button Name After Initiation: Erase
• Description:
  
  ### Warning: Permanent Data Loss
  
  macOS Monterey includes [Erase All Content and Settings](https://support.apple.com/en-us/HT212749), a way to quickly and securely erase all of your settings, data, and apps, while maintaining the operating system currently installed.
  
  Erase Assistant opens and asks you to sign in with administrator credentials.

---

Resources

• erase-install Erasing and reinstalling macOS
• Disabling the Erase All Contents and Settings function on macOS Monterey
• Erase All Content And Settings in Monterey
• macOS Monterey Erase All Content and Settings for companies

[Jared_Y]

There seems to be a discrepancy between the screenshots and the text for the command. In the screenshots there are ` in the first image and none in the second. The text to copy is also missing them. I cannot get this method to work because I am unsure of what the actual command is to call to Erase Assistant to open and run it. Thanks.  

[dan-snelson]

Thanks for the feedback; hopefully this will work better:

/usr/bin/su \- "`/usr/bin/stat -f%Su /dev/console`" -c "/usr/bin/open '/System/Library/CoreServices/Erase Assistant.app'"

[Jared_Y]

Thanks that worked!

@dan-snelson Do you know of a way to invoke and run this from a Standard User account as well? I would block access to it within Self Service by way of limited access logins. 

[dan-snelson]

For Standard Users, you’ll most likely need to go a different route (i.e., `erase-install`).

[iweiss]

@dan-snelson Thank you for this awesome and detailed post! This might be off-topic, but can you clarify why you use the "su -c" convention, rather than using "sudo -u" ?

[martin]

You can just run:

open -a "Erase Assistant"

It will start the process for the current logged in user.

And make sure your user is admin. You might want to (temporarily) elevate the standard user permissions to admin.

[tjhall]

Is there any benefit to this instead of running it via System Prefs?

[user-JamkUnnTYp]

is there anything wrong with that command? we try to run that using the command above but also there we get the following error. Is the method stated above still valid?

[tjhall]

The user has to be elevated to admin before running the command.

[user-JamkUnnTYp]

thank you so much @tjhall . we run it using self service which should run it with elevated rights. Any other ideas? And do you think that's still the way it should work as it's described above? 

[tjhall]

The one above doesn't run in elevated rights. It just opens the build in "erase assistant" which requires admin rights to execute.
You can use erase-install instead (using https://github.com/grahampugh/erase-install).
Create a policy which installs the latest  erase-install package and then a process payload with: /Library/Management/erase-install/erase-install.sh --erase
Beware though, this will wipe the Mac immediately so you really don't want anyone running it by mistake. I suggest it's scoped to specific users only (so they have to log in to see the policy)

[user-JamkUnnTYp]

ok thank you so much for taking the time and for your cool proposal. Usually I would like to avoid third party scripts/tools (this tool uses mistcli), but will double check internally. When we really have to implement it we'll go the route you propsed. Otherwise I would recommend to go with the "hold the power button option" if user wanna reset it by himself. thank you so much, your help is much appreciated!