You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Just wanted some sanity

Hi everyone, apologies if i am not explaining things well. I have a macbook pro with Sequoia 15.1.1 and iphone 14 pro max with 18.1.1 (that gets so hot). I am probably paranoid as I am not overly technical on the mac but I have been having issues with access to my machine (i lose rights to my home directory - downloads, etc) and have been installing things like Adobe Acrobat DC to the latest versions only to notice it seems to revert to an older version. I am no expert but I some logs mention MDM - i notice Classroom and Studentd running on my machine which i try to remove through terminal but am unable to due to the PID changing immediately (there are no visible profiles on in system report and i own the mac and bought from Apple). I have some kext running - obviously some are part of the OS but as i mentioned i am not an expert and perhaps crazy, I have open ports and connections locally and even if i run lsof -i in recovery mode offline i have what appears to be connections - instlogd to port 32376. When i run network scans on my home network I am seeing various ports open on my router, which change or disappear as soon as i dig into them or do another scan (i have blew out the Dlink and now have 2 devices on it only. Tonight i reinstalled yet again (after removing) nordvpn app and i grabbed the logs from the application and it is showing them in the future...it just worries me. below is the EtreCheck output in safe mode. I hate to be a burden and perhaps i am just paranoid but i would really appreciate any comment pos or neg in regards to the output. thank you as i so tired and grateful for any help. James


MacBook Pro 16″, macOS 15.1

Posted on Nov 19, 2024 7:20 PM

Reply
Question marked as Top-ranking reply

Posted on Nov 20, 2024 5:07 AM

To add


From the Etrecheck Report


" 2024-10-07 Mobile Device (1.0.0.0) "



Review MDM restrictions for Apple devices


Restrictions can be turned on—or in some cases, turned off—by administrators to help prevent users from accessing a specific app, service, or function of an Apple device that’s enrolled in a mobile device management (MDM) solution. For example, a restriction can be added that prevents an iPhone or iPad from using AirPrint. Another restriction can be added to prevent the sharing of passwords over AirDrop on an iPhone, iPad, Mac and Apple Vision Pro. Certain restrictions on an iPhone can be mirrored on a paired Apple Watch.

19 replies
Question marked as Top-ranking reply

Nov 20, 2024 5:07 AM in response to jburn_67

To add


From the Etrecheck Report


" 2024-10-07 Mobile Device (1.0.0.0) "



Review MDM restrictions for Apple devices


Restrictions can be turned on—or in some cases, turned off—by administrators to help prevent users from accessing a specific app, service, or function of an Apple device that’s enrolled in a mobile device management (MDM) solution. For example, a restriction can be added that prevents an iPhone or iPad from using AirPrint. Another restriction can be added to prevent the sharing of passwords over AirDrop on an iPhone, iPad, Mac and Apple Vision Pro. Certain restrictions on an iPhone can be mirrored on a paired Apple Watch.

Nov 21, 2024 7:26 AM in response to jburn_67

A few things...


Please do not run EtreCheck in Safe Mode. That totally defeats the purpose of the app.


Please update to the latest version of EtreCheck. I hate seeing my bugs splashed around on the internet.


You have no MDM installed on your computer. That "Mobile Device" is just some poorly-named installer package.


There doesn't appear to be anything wrong with your computer. It would be better to start a new question and better explain what you are seeing with respect to this statement:


I have been having issues with access to my machine (i lose rights to my home directory - downloads, etc)

There are plenty of reasonable explanations. We just need more details about what exactly you are attempting and what, exactly, you are seeing.


Currently, you are about 5 ½ feet deep into a rabbit hole of your own construction. What do you want? A ladder or shovel?


Nov 22, 2024 1:56 AM in response to jburn_67

Normally, when the Author of the question replies to a specific User, I generally do not engage in this reply


Though and since there have been multi contributors appearing and offering suggestions


I figured, why not break my own self Imposed rules.


With these many issues on the computer


As has already been suggested by one of my colleagues  and I thank them again for this


Start Over from Scratch 


For Apple Silicon computer >> Use Disk Utility to erase a Mac with Apple silicon.


IMHO - it would be best to only install new required applications etc Directly from the Developer or the Apple Apps Store.


Notation: Since there’s no evidence of any " Time Machine Backup " or any other form of a backup ( Safety Net ) via a Third Party Software 


The computer is “ Walking on the Tight-Rope without any form of a Safety Net “ sort of speak


What the user decides , is really up to them


For good computer practices


To truly protect your non replaceable Data - have a 3-2-1 Rescue Plan in place and always current


3 Backups using 2 methods and 1 off site incase of natural disaster or un-natural disaster.


Each of the above should be done to a Dedicated, Single Purposed External Drive ( making 3 Separate External Drives in total )


The is to augment what TM Backup does and Not to replace TM Backup.


https://bombich.com




Nov 21, 2024 5:19 AM in response to jburn_67

Should not have or does not have a MDM service Installed on this computer ?


The 2 are not one and the same thing


According to the Etrecheck Report you provided and must say Thank you for that 👍


It made this whole experience far more straight forwards


" 2024-10-07 Mobile Device (1.0.0.0) " is there and on the machine


How and why it is, we can not actually answer


Once a MDM Service is there.


The MDM service can Lock Down pretty much anything they choose to Lock Down


Additional, one the Serial Number of the computer is Registered in the MDM Service Database


It is a difficult experience in getting it removed

Nov 21, 2024 7:27 AM in response to PRP_53

He/she said:


jburn_67 wrote:

Purchased brand new from the apple store. I have owned the machine since that time as well as the iphone which was purchased from a telecom provider. I am not a student and have not been for 30 years!

So your supposition about the device being sold used and not properly prepared for resale would appear to be incorrect.


There's a bunch of other stuff on there, such as NordVPN Threat Protection Pro and Recoverit, that I have to wonder about, though. Whether either would show up as a MDM of some sort I don't know.


Given all the issues that jburn reports, if it were me I'd just erase the system and start fresh, and this time not install NordVPN unless my business or school requires it.


Regards.

Nov 21, 2024 6:05 AM in response to lkrupp

Purchased brand new from the apple store. I have owned the machine since that time as well as the iphone which was purchased from a telecom provider. I am not a student and have not been for 30 years! If there is any other evidence you could help me with in the report, etc. then please do share so i can try and figure this out. Thank you again.


Nov 21, 2024 7:08 AM in response to jburn_67

jburn_67 wrote:

Thank you. Where can i find the database with the serial number mentioned so i can take it to apple at least as i have contacted them in the past asking about MDM and they say it has not been installed?

Short answer


Not on this computer nor in the Etrecheck report


You will have to Contact the MDM Service that has the Computer Serial Number In Their Database


Who the MDM is is unknown


Building on @ Ikrupp assessment


It would appear that this machine may have been New to You but was actually Owned by someone else and Not Properly Prepared for resale

Nov 21, 2024 9:21 AM in response to varjak paw

Guess I let myself " be led down the garden path " by this


Shame on me 😔


" I am no expert but I some logs mention MDM - i notice Classroom and Studentd running on my machine which i try to remove through terminal but am unable to due to the PID changing immediately (there are no visible profiles on in system report and i own the mac and bought from Apple



Nov 21, 2024 9:56 AM in response to PRP_53

PRP_53 wrote:

Good catch 👍 on the outdated Etrecheck application 6.8.6 versus >>

I actually didn't notice the version. I noticed this bug:


Configuration Files:
/etc/hosts - Count:

...that I fixed in 6.8.7.


I also thought it was EtreCheck confusing people about MDMs. Sometimes Apple uses the internal MDM mechanism for certain ScreenTime features. I don't want to print those out as MDM settings. Version 6.8.6 would sometimes print an MDM message about a restricted timeserver or something. Fixed that too. Version 6.8.7 will also help people uninstall orphan system extensions now that Apple has finally made that possible in Sequoia.


Unfortunately, Apple's installation information can be confusing, and EtreCheck can display that confusion. The names of installer packages are essentially meaningless. And there's no way to associate any particular installer package with any specific software. You just have to hope the developer named it something more meaningful than "Mobile Device".

Just wanted some sanity

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.