You Bought the Mac. The Org Still Owns the Serial.

You power on the Mac and never reach the desktop. Setup Assistant stops on a screen titled Remote Management: this device is managed by an organization, sign in to continue. There is no skip button. You see this constantly on second-hand, auction, and ex-corporate Macs: the machine is still enrolled in some company's device management, and that company is gone, unresponsive, or has no reason to help you. You own the hardware and cannot get past its lock screen.

So you reach for one of the scripts that promise to strip the management out. They are easy to find, they run from Recovery, and they work. Reboot afterward and the Remote Management screen is gone. You are at a clean desktop as a local administrator, on a Mac that finally acts like it is yours.

Then you wipe or reset the machine and the lock screen comes back. The bypass was not fake. It edited the wrong layer. You own the metal, but someone else still owns the enrollment, and it lives somewhere your wipe cannot reach.

So the question is not whether the bypass works. It does. The question is where the lock actually lives, why a factory reset is the one thing that brings it back, and what removing it would really take. The answer starts with what the bypass touches, and what it leaves untouched.

What the bypass does

It runs from Recovery against the offline disk and changes four things, all of them local files:

• Blackholes Apple's enrollment domains (deviceenrollment.apple.com, mdmenrollment.apple.com, iprofiles.apple.com) to 0.0.0.0 in /etc/hosts, so the OS cannot phone home to ask who it belongs to.
• Creates a local admin with dscl in the offline directory at dslocal/nodes/Default (UniqueID 501, admin group). That is your login.
• Drops .AppleSetupDone so setup looks finished. Since Sonoma that only holds when a local account already exists, which is why it makes one first.
• Forges the activation state in /private/var/db/ConfigurationProfiles/Settings: it deletes .cloudConfigHasActivationRecord and writes .cloudConfigRecordNotFound, which means "a record may exist but I could not download it." Paired with the blocked domains, the OS reads enrollment as a network hiccup and defers.

The bypass does not remove the leash. It blindfolds the dog.

Every one of those changes is a file on a disk you control. Nothing here touched Apple's servers.

Where the binding lives

This is Automated Device Enrollment, formerly DEP, renamed in 2019 alongside Apple Business Manager. The binding is a record in ABM, on Apple's servers, mapping your serial number to an organization and its MDM server. Not the profile on the disk. The disk only caches the answer.

It was never on your disk by design. Its job is to survive a wipe, a resale, and a new employee, so it lives where you cannot reach it.

At Setup Assistant a Mac activates against albert.apple.com, then asks the enrollment endpoints whether its serial is assigned. If it is, the Mac pulls the profile, contacts the org's MDM, and shows Remote Management. If the org marked enrollment mandatory, there is no prompt. The serial is the key, not your disk and not your login.

Why the wipe wins

The script's edits are local. The binding is not. Erase All Content and Settings, or a reinstall from Recovery, destroys every edit and rebuilds the volumes from a clean install. The bypass is gone, because it was only ever files.

The next boot looks brand new. The Mac activates and asks ABM about its serial, with no hosts block and no forged marker left to stop it, so the lookup runs honestly. The serial is still assigned, because the wipe never touched ABM. Apple returns the record and Remote Management comes back. The reset does not escape the binding. It is how the binding reasserts itself.

What removal actually requires

One path, and it is not on the device: an ABM administrator unassigns the serial from the MDM server and releases the device from the organization's account. Pulling it from the MDM console alone does not work, because if the serial stays in ABM it re-pushes on the next setup. If the org is gone or refuses, only Apple can release it, and only with proof of purchase a third-hand buyer rarely has. That buyer is who these scripts are for. The README admits the serial still shows in the org's inventory afterward.

The take

You can hold the Mac, open it, run any OS that boots. You cannot edit the record that decides who it answers to, because it sits on a server you will never log into. Possession and ownership have split, and the half that decides whether the machine works is enforced remotely. Run the bypass on a machine you own and cannot otherwise use, but know its limit: it hides the enrollment, it does not remove it. The wipe that should hand you a clean Mac is the thing that re-enrolls it.