[HN Gopher] Why is my Mac trying to force me to enroll with Expe...
___________________________________________________________________
Why is my Mac trying to force me to enroll with Expedia Group upon
installation?
Author : josephcsible
Score : 104 points
Date : 2023-12-21 16:48 UTC (6 hours ago)
(HTM) web link (apple.stackexchange.com)
(TXT) w3m dump (apple.stackexchange.com)
| easton wrote:
| I'm curious how that happened in the first place. Telling Apple
| that you want a mac to be autoenrolled in MDM after purchase
| requires you giving them the same proof of purchase you would
| need to get it unenrolled. (At least, it used to. I know now
| definitely for iOS devices you can get them set up in Automated
| Enrollment via Configurator)
|
| Someone at Expedia would've needed the receipt for this laptop to
| get it enrolled, or someone at Apple fat fingered the serial
| number and accidentally enrolled that person's laptop?
| andrepew wrote:
| I imagine it was a fat fingering. I've purchased MBPs for my
| org in person at an Apple Store because I needed them urgently
| and I had to call my Apple rep to manually assign the serials
| to our company in ABM.
| ArnoVW wrote:
| You can manually assign MacBooks to your Apple Business
| account.
|
| Just install Apple Configurator on an iPhone and hold the
| phone close to the laptop at initial boot. It will show a
| sort of QR code and when you scan it it's attached.
|
| The initial detection will only trigger when it is in the
| "choose locale" screen, just after the very first "choose
| language" screen.
|
| If you go beyond "choose locale" it will not work, even if
| you go back a step, and even if you reboot.
|
| Then in ABM change the MDM platform to whatever you want
| (your Jamf instance) and Bob's your uncle
| kristjansson wrote:
| That is simultaneously (a) so freaking cool and (b) the
| most nonobvious, undiscoverable UI/UX I've ever heard of.
|
| "How do you do this sort-of complex business process to a
| new apple device?"
|
| "Oh just install this app on your phone, then hold the
| phone next to the computer when you turn it on. No, don't
| open the app. No, don't lock the phone. No, don't click
| anything on the computer, lest you go too far."
| ArnoVW wrote:
| It's documented. I assure you I didn't find that by
| accident =)
| anonymouse008 wrote:
| Probably a return/cancelled order from Apple Managed side, then
| ended up in general inventory. Evidently there are two
| completely separate customer relationship systems, which makes
| sense given the amount of power given to managed accounts
| (truthfully still boggles my mind the dev and managed aren't
| the same system with the amount of similar power). I would have
| thought inventory would be separated though, but stranger
| things happen.
| millzlane wrote:
| If that is the case, either Expedia, didn't release the
| device before sending it back to apple. Or apple didn't
| release the device from ASM before re-selling the device.
| kotaKat wrote:
| Yep. Had a friend ironically get an Apple Demo Management
| configured Apple TV from an Apple Store. That was a quick
| trip back...
| neverrroot wrote:
| When companies purchase Macs, the serial numbers of those Macs
| could be associated with the respective purchasing company for
| enrollment purposes. Mistakes could happen, but also new (or for
| that purpose even used) Macs could end up being sold _before_
| their serial numbers is disassociated with the company purchasing
| them.
| oneepic wrote:
| That makes a lot of sense. Expedia used Macs heavily when I
| worked there.
| wackget wrote:
| Out of interest, what would happen if you didn't have proof of
| purchase or if, somehow, one day in the future Apple ceased to
| exist and enrollment became impossible?
|
| Would the computer be "bricked" by this or could you wipe it and
| install a fresh copy of MacOS?
| hangonhn wrote:
| You can wipe it and reinstall. This happened to me by accident.
| The software for enrollment at my company didn't work correctly
| when I got my new MBP during my hardware refresh. Not knowing
| any better, I figured the MBP to MBP transfer process messed up
| my new MBP. So I just wiped my new MBP and reinstalled the OS.
| Of course, this also meant my new MBP was no longer enrolled
| and was unable to get all the software distributed by the
| enrollment agent. Once IT figured out what happened, I had to
| wipe it a second time and do the enrollment process again using
| some company specific image that was somehow accessible from my
| home -- maybe from a backup partition?
|
| (Edited: the comments indicates this is no longer possible)
| frizlab wrote:
| That's not true anymore. Now if enrollment is required
| because the computer was bought for a company, you cannot
| bypass it anymore (just like for iPhones).
| joombaga wrote:
| This was not experience when I installed Sonoma on an M2
| MBP a few months ago. Enrollment was easily skipped by
| blocking connection to the enrollment server.
| IG_Semmelweiss wrote:
| I realize this may be straightforqard for an IT admin
| with creds, but does this hold of the avg user? How about
| avg engineer?
|
| >>>>Easily skipped .....by blocking connection to
| enrollment server
| joombaga wrote:
| I don't have any special MDM creds, but I do have an
| admin account on my OS.
|
| Probably not the avg user or engineer (though giving
| engineers admin account on their local OS is common). But
| that's hard to predict because usually you'd want to
| enroll, so I don't often see people trying to avoid it.
| Usually it's because of a bug. In my experience if the
| MDM process is buggy then it's more likely to be
| bypassable.
|
| Setting a firmware password and blocking boot to external
| drives makes it harder, but a lot of orgs don't do it.
| benji-york wrote:
| I'm wondering, does the machine only check enrollment
| once? What if a future OS update institutes regular
| checks?
| joombaga wrote:
| It checks again unless the user cripples the service
| (which requires access to disable System Integrity
| Protection), and even if they do it will be undone after
| am update. But it requires the user to accept the
| enrollment (just a couple clicks on a pop up). I don't
| know that that can be changed.
|
| During OS install the enrollment will just happen; the
| user's acceptance is not required.
| lsllc wrote:
| No you can't. You can wipe & reinstall, but once the Mac
| reboots and connects to the internet, it re-installs whatever
| it is that the "owner" (through device enrollment) wants
| installed. The only way is to get the "owner" (or Apple) to
| release it.
| runlevel1 wrote:
| You're correct that that is the only permanent solution,
| but it can be bypassed until the next reinstall or major OS
| upgrade on Macs like this one as long as (1) you're able to
| change the boot device and (2) there is not a firmware
| password set.
|
| I did it a couple years ago on a last generation Intel-
| based MBP to troubleshoot a problem caused by a particular
| piece of software installed by our IT team who, for various
| reasons, were unable to assist.
|
| Caveat: I don't know if this is possible anymore on Apple
| silicon-based Macs because they apparently "require an
| internet connection to get firmware and other information
| specific to the Mac model."[^1]
|
| The trick was to:
|
| 1. Use a freshly created bootable installer volume.[^1] (If
| previously setup, management software will often inject
| itself into the existing Recovery volume).
|
| 2. Prevent it from connecting to the internet, including
| any previously connected WiFi network it might remember.
|
| 3. Get it through the installation and initial user
| creation without being able to connect to the internet.
|
| After that, it didn't pester me until the next reinstall.
|
| [^1]: https://support.apple.com/en-us/101578
| hedora wrote:
| I'd hope it would be bricked, since that's the point of this
| feature.
|
| (I wouldn't want a laptop with this feature, but I can imagine
| the sort of people that administer MDM asking for it.
| josephcsible wrote:
| > I'd hope it would be bricked, since that's the point of
| this feature.
|
| I wouldn't. A previous owner or manufacturer should never be
| able to brick hardware against the current owner's wishes.
| mcosta wrote:
| Yes but, in Apple's eyes, Who is the owner?
| millzlane wrote:
| Expedia would need to release the device from their ASM/DEP
| portal. Or apple needs to.
| danaris wrote:
| Now, this is speculation on my part, but...
|
| I _think_ if Apple went out of business the service that 's
| causing this problem wouldn't even function anymore, because I
| believe it relies on the MBP phoning home during the setup
| process and being informed that it belongs to the Expedia MDM
| group.
|
| This would then be why fixing it requires a call to Apple,
| rather than being something you can do simply by wiping
| settings on the device itself. (However, I don't know whether
| this means that booting it in a Faraday cage, or just with the
| internet disabled, after wiping device settings would allow
| bypassing it.)
| millzlane wrote:
| We recently are in the process of trying to return a MacBook to
| apple and avoid them dinging our return allotment. My store sold
| to a customer who later called us and said it was making them
| enroll into a PA University's MDM. This was a device that apple
| sold to us directly.
| Longlius wrote:
| I hear a ton of stories about managed devices ending up in the
| hands of general consumers with Apple machines specifically... I
| wonder why? Is Apple particularly sloppy in this regard or is
| this just a matter of Apple computers being extremely popular for
| deployment with MDM?
| skyleradams wrote:
| Most of the time they're stolen and resold to unsuspecting
| buyers on secondhand markets
| chris_wot wrote:
| The school I work for once had a student who had left the
| school sell a MacBook to an unsuspecting member of the public.
| It hadn't been unenrolled.
|
| We wrote it off and removed it from DEP for the poor guy. The
| student was long since gone and we had depreciated it anyway,
| so it wasn't a huge loss. We realised not doing so was also
| potentially a reputation issue for the school also.
|
| We've since tightened up leaving processes so this is unlikely
| to happen again.
| jmbwell wrote:
| The latter. MDM is way ahead on Macs, imho. Intune and
| Autopilot with Windows 10/11 and Azure are only just now
| catching up to what MDM and Jamf can do on Macs, or even what
| Group Policy can do on local devices.
|
| The decommissioning process should generally catch these
| situations, but it's not foolproof, and not all organizations
| have robust decom procedures. A lot of Macs are managed by like
| a University IT dept, but procured and released by individual
| departments, for example. The school of business might not
| bother to notify central IT that they've let go of a bunch of
| old equipment, for example, and if they do it's in some
| outdated spreadsheet, so the machines don't get released
| properly. Things like that.
| kotaKat wrote:
| Funny thing is that Intune/Autopilot aren't infallible either
| to this regard.
|
| I acquired one of those weird lil' mini PCs that are all the
| rage, from Minisforum. The BIOS UUID was, essentially,
| 1-2-3-4-5, if we omit all the zeros. That UUID somehow
| tripped a fresh Windows install into Autopilot mode on the
| box to some random company that enrolled a similarly "blank"
| UUID in. I was absolutely befuddled and laughing my ass off
| once I figured out what happened... after the shock wore off
| of sitting at a Miratech Azure AD login.
|
| ... then dug out an AMI utility to go re-roll the RNG on the
| UUID since the OEM didn't do it and reinstalled Windows again
| and all was well in the world.
|
| You'll also find this happens when you get a Mini PC with a
| sticker telling you "if you cannot log into your personal
| account, please turn off WiFi and LAN, select the skip
| option, and then log in"...
|
| All they need to do is boot a damn flash drive. `AMIDEWINx64
| /su auto` for the win... also thanks to Lenovo for
| accidentally leaving that executable in some BIOS updates.
| sp332 wrote:
| I had this happen with a Samsung phone once that had the Knox
| registered to Rent-A-Center. I called up RAC and they said they
| had no record of the phone.
| gigel82 wrote:
| I had no idea this feature exists; do PCs have this "feature"
| too?
|
| Are we now saying a central authority can simply brick or
| forcefully install software on any mac at any time given only the
| serial number? What the actual fuck!?
|
| Is this an OS feature or part of the "secure enclave" (Are macs
| entirely useless now or can you install Linux and still trust the
| device)?
| chris_wot wrote:
| They can. Surfacebooks can be enrolled into Autopilot. Any OEM
| device running Windows 11 can be preenrolled. It's actually a
| pretty good feature for managing laptop fleets.
| charcircuit wrote:
| >Are we now saying a central authority can simply brick or
| forcefully install software on any mac at any time given only
| the serial number?
|
| Apple can brick or install an update to your computer even
| without MDM. For MDM you can not be spontaneously enrolled. In
| the article the user didn't notice this had been done until he
| reformatted his device.
| jmbwell wrote:
| This is a corporate device management facility. It exists for
| both Windows and Macs.
|
| With Macs, it's more closely tied to the hardware because of
| course they're integrated.
|
| With PCs, Intune and Autopilot are Windows features that depend
| on hardware, but hardware alone isn't sufficient. You can
| install and run Linux or DOS all you want on an Autopilot
| enrolled device, but every time you boot Windows it will want
| to phone home.
|
| It's fairly carefully controlled. With a PC, serial number is
| not sufficient. You need a device specific hash that is not
| generated and that you can't get until you turn on the computer
| at least once, so you need physical possession at some point in
| the workflow.
|
| With Macs, Apple more completely manages those first stages of
| enrollment. Devices are enrolled when sold through a B2B
| channel, or when manually enrolled through Business Manager.
|
| Either way, it would be difficult for an adversary to assume
| control of a device without authorization. Not impossible,
| surely, but it's definitely a scenario these vendors have
| anticipated and worked to prevent.
|
| The good news for device owners is that it adds complexity to
| resale of a stolen device.
|
| The bad news is things like OP's situation occur.
| gigel82 wrote:
| Physical possession is a good enough high bar. But remotely
| enabling this feature with just a serial number sounds
| incredibly invasive, and a very serious breach of trust.
|
| Even if Apple are "the good guys" (now), we know they can be
| compelled by governments to do things quietly (see the push
| notifications thing that came up recently). So simply having
| the ability to remotely push software or configuration
| changes to any machine targeted by just a serial number is a
| big security hole.
|
| This is very disappointing...
| danaris wrote:
| Is it a remote push? Or is it that the MBP "phones home" on
| first boot, and gets the signal that it belongs to the
| Expedia MDM group?
|
| Naturally, that's not great _either_ , but it's not quite
| the same kind of "not great".
| angulardragon03 wrote:
| Second one. It's also not secret - you are greeted with a
| prompt, which you must accept, to complete enrolment
| (although granted you can't use the device without
| accepting).
|
| Essentially, the device phones home during setup, and
| asks Apple whether it's in Apple Business/School Manager.
| If it is, and it's assigned to an MDM, Apple will let it
| know the host name of that server to try and prompt the
| user to enroll into.
| ziml77 wrote:
| Would you prefer the company that owns the device burn
| something like this into UEFI to handle MDM instead?
| gigel82 wrote:
| Yes. That significantly raises the barrier, and reduces
| the risk of accidental enrollment.
|
| And once that's burned into the UEFI, I'd like it
| plastered all over; maybe as part of the boot logo "This
| device belongs to Expedia"; there will be no risk of
| someone buying the device (perhaps on the used market)
| and not realize they don't own it.
|
| Of course, there should also be an un-enrollment option
| for when companies decommission devices so they can be
| reused instead of just trashed, but that's an
| environmental concern not a security one.
| numpad0 wrote:
| 1) Some do. Requires mechanisms to enforce it, which aren't
| present on most laptops yet. Intel ME, motherboard firmware,
| Secure Boot, et cetra et cetra. Some Android phones has it too.
|
| 2) YES.
|
| 3) Part of ... not specifically the Secure Enclave but the
| whole system. Hardware, firmware and software. You cannot
| bypass it.
| kej wrote:
| A similar issue on Windows will be a license key stored in UEFI
| that is tied to a company. A clean install will find that key
| and ask you to login with your company email and password. You
| can get around it by not being online during setup, but you're
| out of luck if you don't know that trick.
| runjake wrote:
| We have some poor soul in Puerto Rico who has a MacBook Pro that
| is tied to our MDM system and, for whatever reason, it cannot be
| removed.
|
| The closest we can tell is that he sent his MBP off to Apple for
| repair and they swapped the logic board with a refurb unit that
| was swapped from one of our machines. There is some internal tool
| that rewrites the serial number and apparently nobody ever
| overwrote the serial number on the removed unit.
|
| So anyway, there's two legitimate MBPs out there with the same
| serial number, although ours is probably decommissioned by now (I
| believe it was a 2015).
|
| Was a funny journey figuring out what the hell was going on,
| though.
| ComputerGuru wrote:
| Can't you remotely deprovision the machine?
| innocenat wrote:
| Can't see how that would go well if two devices have the same
| serial number.
| I_Am_Nous wrote:
| That sounds like something that might also wipe the
| laptop...and all of the new owner's data with it.
| gtirloni wrote:
| That's Apple's problem. For all this company knows, someone
| is using a laptop with their data on it.
| MichaelZuo wrote:
| > There is some internal tool that rewrites the serial number
| and apparently nobody ever overwrote the serial number on the
| removed unit.
|
| How could that be possible?
|
| Apple's internal systems won't allow a second
| motherboard/computer with the same serial to even pass the
| post-repair diagnosis.
| droopyEyelids wrote:
| Maybe the second computer hasn't been manufactured yet
| MichaelZuo wrote:
| Why would the factory assign, to a second computer, a
| number that's already been assigned to a computer which has
| been manufactured some time ago?
| droopyEyelids wrote:
| It wasn't assigned to a computer manufactured some time
| ago, it was assigned by a tech in some repair depot, and
| for all we know it happened a moment before.
| MichaelZuo wrote:
| The factory's serial assignment systems are connected to
| Apple's internal systems that would also have recorded
| the 'tech in some repair depot' assigning that number?
|
| It doesn't literally have to be from the same factory, as
| it could be any one of the dozens of factories or
| hundreds of repair depots.
| millzlane wrote:
| And tech used the part during a repair, did system
| configuration with the board, realized that wasn't the issue,
| and then removed it and sent it to back to apple. I've had a
| tech do it once.
|
| I'm not sure how the "Diag" board would have ended up in the
| hands of a customer. We note that the part was opened and
| used.
| jabroni_salad wrote:
| Yeah I disagree with that as well. Here is a much simpler
| story:
|
| When you install a blank motherboard, you need to key in the
| desired serial number. If you make a mistake, you are
| supposed to ask apple to re-ship a blank and you take an
| oopsie on your record.
|
| Someone did the oopsie, but it validated so they either never
| noticed or didn't feel the need to call it in.
| Animats wrote:
| "Contact Apple support with your purchase details and ask them to
| fix the enrollment of the serial number on the affected Mac. It
| sounds like there was a clerical mixup on the record keeping as
| part of automated device enrollment."
|
| Funny how these "mixups" always seem to benefit the company
| trying to control the user.
| ziml77 wrote:
| The mixups go in both directions
| https://news.ycombinator.com/item?id=38724253
|
| Also I'm not really sure what benefit you're saying Apple even
| gets here. They have to waste time confirming all sorts of
| details so they don't unenroll a stolen device from MDM. Just
| seems like it's nothing but a pain for everyone involved.
| tcfunk wrote:
| Interesting, I recently got a MPB for a new job that was
| _supposed_ to have some enrollment pre-configured, but didn 't.
|
| Weeks into my new job, the IT folks contacted me and asked "Uh,
| did you ever get your laptop?"
| annoyingcyclist wrote:
| I had this happen with an iPad that I received as an exchange
| when I sent one in for a repair. I booted the new unit up and was
| prompted to enroll the device in MDM for a school district in
| Florida. Kind of a frustrating experience, but Apple support was
| eventually able to get it unenrolled after enough escalations
| ("yes, I bought it from you", "no, I'm not going to sign in to an
| MDM-enrolled device with my personal Apple ID", "no, I've never
| heard of this school district and don't know anyone in IT there
| who could unenroll the device", "yes, I'm quite sure I didn't buy
| it off a truck").
|
| I never learned what caused the issue.
| someonehere wrote:
| This could easily been Expedia's VAR submitting the serials to
| Apple Business Manager and having one of them off by a character.
|
| I would assume Expedia buys in bulk so it's possible all the
| serials that were scanned in could have had one or several
| serials entered wrong.
|
| Generally when you buy a batch/bulk order, the last four will be
| different than the initial 8 for several dozen machines in that
| batch.
| tallmed wrote:
| Gnu/Linux doesn't have this problem
| terminous wrote:
| It's in the hardware.
| NikkiA wrote:
| The used mac market is too risky, it's too easy for the seller to
| remote disable it, or it be locked into bullshit like this. I'm
| surprised anyone still dares to buy used.
___________________________________________________________________
(page generated 2023-12-21 23:02 UTC)