MDM enrollment processes present on my iPhone without my authorization

Question

MDM enrollment processes present on my iPhone without my authorization

I have been having the same issues with my current iPhone 13 purchased in May 2025 that I've had with past iPhones since 2013, specifically the inability to back it up to my iCloud. I executed sysdiagnose 11-23-25 after recently learning that it is a good tool to use in diagnosing problems with the device. i opened one of the first files I came across in its main folder named "jetsam_priority," which contains 397 processes. Listed within those are: managedappdistributiond, ManagedSettingsAgent, dmd, and betaenrollmentd. I have not authorized enrollment in MDM or beta, and no one except me has had physical access to my iPhone. There also are no visible profiles in my iPhone's settings.

Does anyone have any input on how this situation could happen or why these processes would be present? I read online that covert MDM enrollment is possible, although rare. Does anyone know anything about this?

[Re-Titled by Moderator]

Original Title: Covert MDM Enrollment?

Posted on Nov 27, 2025 8:05 PM

Reply

Answer 1

Nov 30, 2025 12:38 PM in response to 000over_it000

000over_it000 wrote:

This is truly way over my head. I did want to share a couple more points, though, that may be relevant?

logs>MCState>Shared>PublicInfo>MCMeta.plist references "AllowedGrandfatheredRestrictions" and "LastMDMMigratedBuild"; and also in Shared folder is MCSettingsEvents.plist, which I mentioned earlier, and it shows this after each setting: "value: set", "process: MCRestrictionManagerWriter.Recompute

EffectiveUserSettings". The "forced" settings I referenced earlier in Truth.plist correspond with these settings. This is all basically foreign to me. Like I said, I have a lot to learn regarding MDM. I do appreciate your input.

So far, all of what you have posted looks like log chatter.

What is this? More MDM plumbing, signifying, well, more MDM plumbing.

Here is an MCMeta.plist example that’s been previously posted elsewhere:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>LastMigratedBuild</key>
	<string>9B176</string>
</dict>
</plist>

These particular MCMeta file contents are not particularly interesting. Specifically, it is the XML format and character set encoding, the XML documentation type, plist format version, a key named LastMigratedBuild with the key value string 9B176, and the usual end of the file markers. TL;DR: mundane and ordinary housekeeping.

The MCSettingsEvents plist file usually contains info on Managed Configurations settings changes, if any.

More generally, the concerns about MDM and the reported twelve years of issues will not be resolved here.

Reply

Answer 2

Dec 1, 2025 8:43 PM in response to MrHoffman

One last question, and then I promise to be done with this thread. I copied this from security-sysdiagnose.txt:

.."2025-11-22 23:33:18 +0000

EventHardFailure: PinningEvent - Attributes:

{Caller: com.apple.Preferences,

Policy: sslServer,

product: iPhoneOS,

version: 26.1,

Hostname: v-collector.dp.aws.charter.com,

TrustResult: 4,

SerialNumber: 0D85EAD1848463BFC05643370C080340,

modelid: iPhone14,5,

IssueName: Amazon RSA 2048 M03,

build: 23B85}"

Is this normal?

Reply

Answer 3

Dec 2, 2025 4:12 PM in response to MrHoffman

Ok, thanks. I just don't understand why com.apple.Preferences would be trying to connect with charter communications, spectrum, or amazon aws - specifically v-collector.dp.aws.charter.com - when I don't use any of their services. I guess I'm missing something. Also, that security-sysdiagnose.txt file has 64 pinning event hard failures.

Reply