New Feature: Local MDM Bypass for Dual-Boot macOS Setups (with sudo access)

[peterrakolcza]

Summary

This update adds a new script and section to the documentation that explains how to bypass MDM locally when you already have access to an enrolled macOS installation with sudo privileges—enabling a dual-boot setup with a personal, unmanaged macOS installation.

---

Use Case

Imagine you’ve received an MDM-enrolled Mac from your company. As a developer or technical user, you might have been granted sudo privileges to perform necessary tasks. However, you may want to:

• Keep the enrolled OS intact (for work or secure access to company resources),
• But also run a personal macOS installation free of MDM restrictions.

Dual-booting is the perfect solution in this scenario.

---

Problem

When attempting to install a fresh copy of macOS on a new partition and boot into Recovery Mode for that new installation, macOS throws this error:

"There Are No Users on This Volume to Recover"

As a result, you’re unable to access recovery mode on the fresh install and cannot run the MDM bypass script from there.

---

Solution

This PR introduces a new script and documentation for the new method:
Run the bypass script directly from the enrolled OS, using sudo, to modify the second, freshly installed macOS volume.

This was successfully tested on an Macbook Pro with M4 Pro running macOS Sequoia 15.5.

---

Benefits

• Enables personal use of your device without compromising the company-managed environment.
• Provides a workaround when native recovery access is blocked by system limitations.
• Helps developers or tech users safely isolate work and personal environments.

[Neustradamus]

Dear @assafdori,

Any progress on this PR?

[awareunlikeu]

This is awesome Thanks!

[mateussiqueira]

Revisão técnica do PR #74 — Dual-boot

@peterrakolcza, ideia útil para o cenário de dual-boot. Porém encontrei alguns problemas no código:

Bugs encontrados

1. Typo no volume padrão: "Machintosh HD" (faltando o "c" — o correto é "Macintosh HD"). Isso aparece duas vezes (linhas 28-29). Se o usuário der Enter sem digitar nada, o script tenta acessar /Volumes/Machintosh HD que não existe.

2. Path quebrado do ConfigurationProfiles (linha 84):

   rm -rf "/Volumes/$baseVolume/db/ConfigurationProfiles/Settings/..."

   Está faltando /var/ — o correto é /Volumes/$baseVolume/var/db/ConfigurationProfiles/...

3. Variável de cor errada (linhas 18, 24): usa ${RED} para fechar — deveria ser ${NC}:

   echo -e "${RED}Error: ... ${RED}"   # ERRO: fecha com RED em vez de NC

4. Mesmo problema do v1: escreve no System Volume (/etc/hosts em /Volumes/$baseVolume) em vez do Data Volume. Em Apple Silicon com SSV selado, essas escritas não persistem após reboot. Vide PR Add v3: Apple Silicon / SSV-aware bypass (fixes macOS 26 re-enrollment + FileVault Recovery) #170 que explica a causa raiz.

Problema conceitual

O script é para ser executado do macOS instalado (com sudo), não do Recovery. As opções do menu dizem "Bypass MDM from Recovery" mas a descrição do PR diz que roda com sudo. Inconsistência que confunde o usuário.

Sugestões

• Corrigir os typos e paths
• Renomear a opção do menu para "Bypass MDM (Dual-boot — from sudo)"
• Adaptar para escrever no Data Volume (seguir a abordagem do v3)
• Adicionar validação de input (username/password)
• O README doc poderia ser separado do diff principal para reduzir conflitos

Conflito de merge

O PR está marcado como CONFLICTING — precisa de rebase com a main atual.

[mateussiqueira]

Hey @peterrakolcza, the dual-boot idea is neat — having a separate personal install alongside the company-managed one is something a lot of devs ask for.

I found a few bugs when I tested the script locally though:

1. Typo in volume name: you wrote Machintosh HD (missing the "c"). Its Macintosh HD. If someone hits Enter without typing anything, the script tries to access /Volumes/Machintosh HD which doesnt exist and fails silently-ish.

2. Missing /var/ in one of the paths:

rm -rf "/Volumes/$baseVolume/db/ConfigurationProfiles/Settings/..."

Should be:

rm -rf "/Volumes/$baseVolume/var/db/ConfigurationProfiles/Settings/..."

3. Color code bug: in the error messages you use ${RED} to close the color instead of ${NC}:

echo -e "${RED}Error: ... ${RED}"  # should be ${NC}

4. System volume vs Data volume: This writes to /Volumes/$baseVolume/etc/hosts which is the System volume. On Apple Silicon, thats sealed — writes wont survive a reboot. It should target /Volumes/$dataVolume/private/etc/hosts instead (the Data volume). Same for the ConfigurationProfiles paths.

5. Menu option naming: The option says "Bypass MDM from Recovery" but the script is meant to run from the enrolled macOS (with sudo), not Recovery. Thats confusing.

Also heads up — the PR is showing as CONFLICTING with main, so itll need a rebase.

Ive got a fixed version if you want me to share it.