Profile feature of System Prefs in Yosemite

[Ormond]

Hi again Cory,

The point is this...it cannot be enrolled again after deletion, because they would need several pieces of information to re-enroll it: UUID, serial number, IP address, etc.

Ok, but um, they already have that information. But I don't want to pound this to death. I agree they are unlikely to want to re-enroll it. Fair chance they won't want to bother with un-enrolling it too. Ticket to MacOfAllTrades unanswered so far.

Because it is then enrolled in the MDM and registered with DEP, the security/tracking components come into play, as well as the ability to automatically configure it if it is erased completely, when it contacts Apple's servers during the Setup Assistant phase.

I could of course be wrong given my novice status on this issue, but so far at least I seem to have found a way around the automatic Profile setup.

1) Install OSX on a backup drive connected to another Mac. Thus, Setup Assistant doesn't see affected Mac.

2) Copy that OSX over to the affected machine.

The MDM Profiles are not installed on the affected machine, but....

The affected machine does toss up a nag screen each time you boot asking you if want to install the MDM Profiles. I find this puzzling, but it's progress.

If I knew how to write an Applescript or other mechanism to auto-dismiss the nag screen, I think I'd be done. At least that's what it looks like now. It wouldn't surprise me to be further surprised however.

Thanks again for educating me on this issue. Without you I'd still be deep in the dark.

 

[Ormond]

To serve the many of thousands of readers eagerly awaiting each update to this thread....

I found the docs for the MDM Profile software:
https://help.apple.com/profilemanager/mac/5.2/#/

If I understand it (I may not) it looks like all you need is a serial number or UUID to take control of a remote Mac with this software. See this page:

https://help.apple.com/profilemanager/mac/5.2/#/apdC8764F44-B9DB-4799-A694-BEDA42DABEBF

Feel free to debunk my statement above, it may very well be wrong. Hopefully it is wrong.

If it's not wrong, then Mac users should be very careful who they share their serial number or UUID with.

In other news, after a few days of silence MacOfAllTrades reports they have contacted the college and requested my removal. It seems this has happened before and they are used to the routine. Or to put it another way, MacOfAllTrades knew this Mac might be affected by this issue, but didn't bother to check before shipping it to me.