May 182017

Recently my employer gave me a brand new MacBook. Never had one, but so far I’m impressed and I like it a lot. One thing to know is that MacBooks or MacOS in particular, are not supported by my employer. You can get one, but basically you’re on your own if something breaks (software, hardware is covered).

The first day of using the machine, I noticed a recurring popup, asking me to participate in my employers Device Enrollment Program. Which is weird. The device enrollment program enables organisations to remotely manage the device, so deployment of new software for example is made possible that way. But….MacOS is not supported by my employer, so why the popup?

After some inquiries I learned that I could “safely ignore the popup”. Right. Everytime an annoying popup, distracting me from what I am doing at that moment, cancelling it by clicking on it. And repeat that every ten minutes or so. Not the answer I was hoping for.

There is a way to disable the popup. You need administrator rights and it involves a couple of reboots, but after that, it’s gone. Here’s how.

– Reboot the machine in recovery mode. This can be done by pressing and holding COMMAND + R when the machine reboots
– In recovery mode choose Terminal from the Utilities menu
– In the terminal window, run the command “csrutil disable” and reboot the machine when asked
– After logging in, open a terminal window and give the following commands:
-> sudo mkdir /Library/LaunchAgentsDisabled
-> sudo mkdir /Library/LaunchDaemonsDisabled
-> sudo mv /System/Library/LaunchAgents/ /Library/LaunchAgentsDisabled/
-> sudo mv /System/Library/LaunchDaemons/ /Library/LaunchDaemonsDisabled/
– Now reboot the machine, again in Recovery mode by pressing and holding COMMAND + R while restarting
– From the Utilities menu start a Terminal again, and run the command “csrutil enable”. Reboot the machine when asked

This should do it. You can check if the popup is gone by issuing the following command in a Terminal window:

– launchctl list | grep enroll

This should come up with no (empty) results.

The “csrutil” tool is to disable or enable the System Integrity Protection. You should re-enable it (so don’t skip the last step), because it gives your system an extra layer of protection.

  13 Responses to “Disable Device Enrollment popup”

  1. Thank you! This finally killed that popup that has been annoying me for months! Thank you. Thank you.

  2. sudo mv /System/Library/LaunchDaemons/ /Library/LaunchDaemonsDisabled/

    is wrong. it should be …/

  3. So i tryed this but when type first line
    sudo mkdir /Library/LaunchAgentsDisabled

    am tryin this but its said that does not exist, any help?

    • Can you tell me what the error is? What does not exist?

      • When i type first command in Terminal:
        sudo mkdir /Library/LaunchAgentsDisabled

        its said:
        sudo mkdir /Library/LaunchAgentsDisabled: command not found

        • It looks like your PATH is messed up. Type “echo $PATH” on your commandline. It should include /usr/bin. Something like this is correct:

          $ echo $PATH

  4. this is wha i got

    echo $PATH

    • I honestly don’t know why it doesn’t work for you. “sudo” is a command that is in /usr/bin. The command “mkdir” should be in /bin, but that directory is also in your PATH. Both commands are part of standard MacOS, no need to install extra software, so I can’t really tell what’s happening on your Mac. Sorry about that.

  5. Worked for me. Thank you very much!

  6. This was working for me for a few months but recently some users are reporting the issue came back again. I think upgrading to High Sierra broke this command. I don’t have the machine in hand so I cannot confirm.

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>