May 182017
 

Recently my employer gave me a brand new MacBook. Never had one, but so far I’m impressed and I like it a lot. One thing to know is that MacBooks or MacOS in particular, are not supported by my employer. You can get one, but basically you’re on your own if something breaks (software, hardware is covered).

The first day of using the machine, I noticed a recurring popup, asking me to participate in my employers Device Enrollment Program. Which is weird. The device enrollment program enables organisations to remotely manage the device, so deployment of new software for example is made possible that way. But….MacOS is not supported by my employer, so why the popup?

After some inquiries I learned that I could “safely ignore the popup”. Right. Everytime an annoying popup, distracting me from what I am doing at that moment, cancelling it by clicking on it. And repeat that every ten minutes or so. Not the answer I was hoping for.

There is a way to disable the popup. You need administrator rights and it involves a couple of reboots, but after that, it’s gone. Here’s how.

– Reboot the machine in recovery mode. This can be done by pressing and holding COMMAND + R when the machine reboots
– In recovery mode choose Terminal from the Utilities menu
– In the terminal window, run the command “csrutil disable” and reboot the machine when asked
– After logging in, open a terminal window and give the following commands:
-> sudo mkdir /Library/LaunchAgentsDisabled
-> sudo mkdir /Library/LaunchDaemonsDisabled
-> sudo mv /System/Library/LaunchAgents/com.apple.ManagedClientAgent.enrollagent.plist /Library/LaunchAgentsDisabled/
-> sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.enroll.plist /Library/LaunchDaemonsDisabled/
– Now reboot the machine, again in Recovery mode by pressing and holding COMMAND + R while restarting
– From the Utilities menu start a Terminal again, and run the command “csrutil enable”. Reboot the machine when asked

This should do it. You can check if the popup is gone by issuing the following command in a Terminal window:

-> launchctl list | grep enroll

This should come up with no (empty) results.

The “csrutil” tool is to disable or enable the System Integrity Protection. You should re-enable it (so don’t skip the last step), because it gives your system an extra layer of protection.

  42 Responses to “Disable Device Enrollment popup”

  1. Thank you! This finally killed that popup that has been annoying me for months! Thank you. Thank you.

  2. sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClientAgent.enroll.plist /Library/LaunchDaemonsDisabled/

    is wrong. it should be …/com.apple.ManagedClient.enroll.plist

  3. So i tryed this but when type first line
    sudo mkdir /Library/LaunchAgentsDisabled

    am tryin this but its said that does not exist, any help?

    • Can you tell me what the error is? What does not exist?

      • When i type first command in Terminal:
        sudo mkdir /Library/LaunchAgentsDisabled

        its said:
        sudo mkdir /Library/LaunchAgentsDisabled: command not found

        • It looks like your PATH is messed up. Type “echo $PATH” on your commandline. It should include /usr/bin. Something like this is correct:

          $ echo $PATH
          /usr/local/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Applications/Wireshark.app/Contents/MacOS:/Applications/maven/bin

  4. this is wha i got

    echo $PATH
    /usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin

    • I honestly don’t know why it doesn’t work for you. “sudo” is a command that is in /usr/bin. The command “mkdir” should be in /bin, but that directory is also in your PATH. Both commands are part of standard MacOS, no need to install extra software, so I can’t really tell what’s happening on your Mac. Sorry about that.

  5. Worked for me. Thank you very much!

  6. This was working for me for a few months but recently some users are reporting the issue came back again. I think upgrading to High Sierra broke this command. I don’t have the machine in hand so I cannot confirm.

  7. Hey,

    After i put in this line sudo mkdir /Library/LaunchAgentsDisabled and press enter, it’s asking me for a password. What should I do?

    • It needs your password. If you’re allowed to become “root”, the command will run after supplying your own password.

  8. In Recovery the Terminal is in Bash. The doable csrutil works but when sudo anything I get sudo command not found.

  9. If this posted twice. Sorry. I’m in Bash and sudo commands not found

  10. Thank you for the great walk-through

  11. hey good evening
    I have tried your instruction as noted and follow all the line even with the correction. I have to say I got this message
    (– launchctl list | grep enroll
    -bash: –: command not found)
    I don’t know what I have don’t wrong is there anyway you could help me out please
    pierre

  12. Thank you for this great guide, and it worked like a charm – Muchas Gracias mi amigo!!!

  13. Thanks for the steps. Does this work on Mojave as well?

  14. Thanks for the steps. Does this work on Mojave as well? I am getting “No Such File or Directory” on:

    sudo mv /System/Library/LaunchAgents/com.apple.ManagedClientAgent.enrollagent.plist /Library/LaunchAgentsDisabled/
    sudo mv /System/Library/LaunchDaemons/com.apple.ManagedClient.enroll.plist /Library/LaunchDaemonsDisabled/

  15. you are a godsend!

    …if you were a man i’d blow you…unless you were uncircumsized…then just a loving handjob. but seriously, thank you, as someone who has never touched terminal this walkthrough was perfection.

  16. you are a godsend!

    …if you were a man i’d blow you…unless you were uncircumsized…then just a loving handjob. but seriously, thank you, as someone who has never touched terminal this walkthrough was perfection.

  17. Did somebody found a workaround for Mojave 10.14.2? as people previous mentioned I can disable csrutil but everything else show directory not found.

  18. Thank you very much for this: when I checked it with the
    launchctl list | grep enroll command;
    I got this answer:
    – 0 com.apple.ManagedClientAgent.enrollagent

    Does the zero mean that I have eliminated it or do I need to go through the steps again?

    • The result should be empty, any output means something did not work or wasn’t disabled. I’m sorry, I don’t have a Mac anymore so I can’t check it for you.

  19. works thanks

  20. im having the same issue on Catalina it wont remove the file any help ?

    • I don’t have any system in my possession to test things on. Do you get error messages or nothing at all?

      • i do all the step and when i check in terminal it says

        – 0 com.apple.ManagedClientAgent.enrollagent

        and it still pops up

  21. any help out there or any one on Catalina ?

    i do all the step and when i check in terminal it says

    – 0 com.apple.ManagedClientAgent.enrollagent

    and it still pops up

  22. Need an update for Catalina pretty pretty please. This is annoying af.

  23. Hello, I need help. I have a 2015 Macbook air running on Yosemite. I did a complete wipe including deleting the volumes… I even installed the new os without internet, but after I connected it to my wifi the prompt of dep keeps popping up. And when I typed csrutil disable it says command not found. Please help!

    • Sorry, I can’t help you with that. I don’t have a Mac(book) anymore, so please ask somebody nearby that has one or would be able to help you. Hope you can sort it out!

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

(required)

(required)