How to Check a MacBook Pro 2015 for MDM or iCloud Bypass Before Buying

The only way to be certain is to see the Mac in person before you part with your money, have the seller boot it up for you. If you see either the scrolling multilingual 'hello' message or the Select a Region dialog box, the Mac is activated for use by a new owner.

If you see anything else, have the owner follow these steps:

What to do before you sell, give away, trade in, or recycle your Mac - Apple Support

(or just walk away).

neuroanatomist wrote:

The only way to be certain is to see the Mac in person before you part with your money, have the seller boot it up for you. If you see either the scrolling multilingual 'hello' message or the Select a Region dialog box, the Mac is activated for use by a new owner.

If you see anything else, have the owner follow these steps:

What to do before you sell, give away, trade in, or recycle your Mac - Apple Support

(or just walk away).

No, that is not accurate. I see that screen on my organization's Macs when they are not completely enrolled.

It is very hard to be sure a Mac is not still enrolled in an MDM.

There are ways to sort of prevent a clean OS from showing an MDM connection....at least for a little while, but eventually it will show up. I was able to prevent an MDM enrollment message from appearing during a clean install of macOS on an Intel Mac during installation & initial setup several years ago. In fact, I didn't see any MDM management messages for several days after a clean install & initial setup of user accounts. Some of it does depend on how the organization has their MDM setup & how strict they are about it.

A prospective user would want to go through the initial setup & configure a new macOS user account. Many times (not always) this will reveal whether a Mac is enrolled in an MDM, but the Mac must be connected to the Internet.

I don't think there is any way to guarantee a Mac (or any Apple device) is completely free & open from an MDM or a previous user's AppleID/iCloud (with the latter, assigning your AppleID & checking you have full control may be an option, but do you really want to do that on a device you may not take with you & on someone else's network that could be tracking things).

It would be nice if Apple actually allowed users to enter a system serial number on the Apple website to confirm a device has no ties to an MDM or AppleID/iCloud, but Apple doesn't care about second sales as there is no money for them unless the device is traded into Apple.

Edit: After a clean install of macOS, the computer will show no signs of enrollment in an MDM until you start the Setup Assistant process. After selecting the Network connect, you may get a sign the device is enrolled in an MDM as it will force an Internet connection...why it has to wait to that point is beyond me. It should clearly show such a state on the welcome screen so users cannot hide it from a prospective buyer.

PixelRain wrote:

However, if the seller completes the factory reset beforehand, the download will already be finished by the time I receive the MacBook at the ‘Hello’ screen.

Yes, that's the point of the word before in the of the process described in What to do before you sell, give away, trade in, or recycle your Mac - Apple Support. The seller should already have performed those steps, because after doing so the Mac should be ready for a new owner to set up.

If you're determined to do this, taking into account the advice above I would suggest before the purchase you go through an 'anonymous' setup process. In the Setup Assistant, assign an anonymous username ('Bob') and simple password ('password123' or something you will not forget), skip through most of the steps, i.e. do not sign into your Apple Account, do not set up Touch ID or Apple Pay, etc., then when you get to the desktop go to Apple menu > System Preferences > Profiles and confirm that it's blank (that is where MDM profiles show up; my screenshot below is different, a 2015 Mac should be running macOS 12 Monterey).

Assuming all looks good, before you actually set it up for yourself start over – go to System Preferences and in the System Preferences menu select the Erase All Content and Settings option. That will get you back to the Setup Assistant with a clean slate and at that point you can fully set up the Mac.

Thanks for the corrections. When erasing a Mac (from recoveryOS) and then installing macOS, the Mac requires an internet connection, and after that is provided it reports “This Mac is Activated.”

I tried that with a Mac enrolled in our MDM (which is administered by a 3rd party IT provider), and could not get to that point until the Mac was unenrolled. As you say, it may depend on the MDM system in use.

As for the implication that Apple does care about second sales on devices traded in to them, maybe not. My initial advice was based in part on a statement from an Apple Store employee about trading in Macs when I asked specifically about MDM, and I was told that the Mac had to show the Setup Assistant and that confirmed it was ‘clean’.

In retrospect, that same employee told me I could bring in as many Macs as I had to the store and I learned the hard way (yesterday, in fact, after carrying two bags with a combined 16 Macs) that they only accept five devices per person per day.

Still, all the person handling the trade-ins did was look briefly at the screen after each Mac booted (all are at the Setup Assistant stage) then close it and flip it over to capture the serial number.

Back on topic, the bottom line is that buying a second-hand Mac is always a big risk.

There is a more than a bit of a Catch-22 type problem with this.

What you would like to see is:

Settings > General > Device Management

shown no installed MDMs.

But, but, but --

'Settings' should not be available AT ALL if they re-installed MacOS and shut it down at the "Hello in 20 languages" Setup Assistant screen.

<< when I start it and go through setup, any MDM lock should appear. Is that correct? >>

I believe that to be true, but I defer to my more knowledgeable colleagues.

--------

<< so the seller may not want to wait. >>

OF Course the seller of a STOLEN MacBook Pro "does not want to wait" !

As you know, MacOS download and install can be done in the background. You do not have to sit there for 1.5 hours while it exclusively downloads and preps for install.

PixelRain wrote:

So, if I ask the seller to factory reset the MacBook and leave it at the ‘Hello in 20 languages’ Setup Assistant screen, then when I start it and go through setup, any MDM lock should appear. Is that correct?

No/Maybe. The MDM notice may appear. Several years ago I was able to bypass my organization's MDM completely so I could have a pure clean OS installation. I would go through setup assistant offline and may not see any MDM notices until days or weeks later.

If the Mac is connected to the Internet, then an MDM should appear. If the Mac is not connected to the Internet, who knows.

These days I can no longer bypass my organization's MDM notification. I don't know whether that is due to our MDM being more aggressive & strict, or whether Apple changed something so that the Mac's firmware has a flag to indicate a managed system & forces an Internet connection so that the Mac can be enrolled in the MDM. I never tried to investigate the reason for this change of behavior.

If you start going through Setup Assistant and that Mac is connected to the Internet (hopefully the seller is not doing anything to trick you) and you are not greeted with an MDM notification, then you have a somewhat reasonable chance of it being Ok (still a risk without knowing if Apple has flagged the firmware to force an Internet connection if still being managed....important details like this are hard to find). This MDM notification occurs before you are asked to create any user accounts....basically you select a language, then a network, then you will either see an MDM notification or will be prompted to create a macOS user account.

However, if the seller completes the factory reset beforehand, the download will already be finished by the time I receive the MacBook at the ‘Hello’ screen.

Correct.

To ensure the MacBook Pro 2015 is free from MDM or iCloud lock before buying, the best approach is exactly as described: ask to see the Mac in person and have the seller power it on. If you see the initial setup screens like the scrolling multilingual “hello” message or the “Select a Region” dialog box, that means the Mac has been reset and is ready to be set up by a new user, indicating no active iCloud lock or MDM enrollment.

If the Mac boots into anything else, such as a login screen or a profile management page, then it may still be linked to the previous owner’s Apple ID or managed via MDM. In that case, ask the seller to follow Apple’s official instructions on how to properly erase and prepare the Mac for a new owner (as per Apple Support’s “What to do before you sell, give away, trade in, or recycle your Mac”). Without seeing the setup screen, you cannot be fully sure the device is clear of iCloud lock or MDM.

click here, What to do before you sell, give away, trade in, or recycle your Mac - Apple Support.

PixelRain wrote:

Out of curiosity and to better understand, on macrumors I read that pressing Cmd + Q at the “Hello” setup screen may show a Shutdown option to turn off the MacBook. However, it might not work on the very first screen and may only appear after selecting a language. Even if the language has already been chosen, the MacBook should still return to the “Hello” screen when powered on again, correct?

Correct. Just tried on one of my stack of remaining Macs, you cannot use Command-Q on the select language dialog, but after that (select region or later), you can. This is the screen after region selection:

After quitting the Setup Assistant, starting up the Mac shows the scrolling multilingual Hello opening.