MP 1,1-5,1 Mysterious Popup on Screen

[tsialex]

Try a clean install of Sierra to an empty disk, see if you get this pop-up again. Don't use the installer you already have, download it from Apple here, this is the direct link for Sierra 10.12.6 full installer:

https://updates-http.cdn-apple.com/2019/cert/061-39476-20191023-48f365f4-0015-4c41-9f44-39d3d2aca067/InstallOS.dmg

This is the support article:

How to download and install macOS - Apple Support

Download and install current or previous versions of the Mac operating system on compatible Mac computers.

support.apple.com

 

[trixman]

The file name "InstallOS.dmg" is the same name as the file I downloaded yesterday, it was 5.0

Try a clean install of Sierra to an empty disk, see if you get this pop-up again. Don't use the installer you already have, download it from Apple here, this is the direct link for Sierra 10.12.6 full installer:

https://updates-http.cdn-apple.com/2019/cert/061-39476-20191023-48f365f4-0015-4c41-9f44-39d3d2aca067/InstallOS.dmg

This is the support article:

How to download and install macOS - Apple Support

Download and install current or previous versions of the Mac operating system on compatible Mac computers.

support.apple.com

The file name "InstallOS.dmg" is the same name as the file I downloaded yesterday, it was 5.01 GB. The link does not work and did not work yesterday, see picture from today. I had to go to the apple.com website and work my way down to the download from there.
Also when you say install to an empty disk, I have none of which are empty, all of my disks have files on them. I have three installed in the MacPro one for the OS, two for data, and one external USB disk also for data.
I will open out the support article, it may be one that I read yesterday, But I'll check it.

 

[iStorm]

This is definitely from MDM or DEP and is likely coming over the internet; not anything you have done recently. The OS periodically checks to see if the Mac is registered in the Device Enrollment Program (DEP).

You say you have owned the Mac Pro for many years, but where did you purchase it from? Was it from a retailer, or second-hand off eBay, Craigslist, etc? And/or have you had any repair done to it? The only reason I ask is other people have gotten similar messages after upgrading their OS, and it had to do with their Mac or logic board being registered with some school district or company. Here's one example of this happening:

https://discussions.apple.com/thread/7272370

It sounds like the same thing could be happening here. It seems you may have either unknowingly bought a stolen Mac, or the Mac was repaired using a logic board from a stolen device, or the Mac wasn't removed from the school's system when they got rid of it.

You'll most likely have to contact the school district with your serial number and see if they're willing to remove it from their MDM/DEP system.

 

[trixman]

This is definitely from MDM or DEP and is likely coming over the internet; not anything you have done recently. The OS periodically checks to see if the Mac is registered in the Device Enrollment Program (DEP).

You say you have owned the Mac Pro for many years, but where did you purchase it from? Was it from a retailer, or second-hand off eBay, Craigslist, etc? And/or have you had any repair done to it? The only reason I ask is other people have gotten similar messages after upgrading their OS, and it had to do with their Mac or logic board being registered with some school district or company. Here's one example of this happening:

https://discussions.apple.com/thread/7272370

It sounds like the same thing could be happening here. It seems you may have either unknowingly bought a stolen Mac, or the Mac was repaired using a logic board from a stolen device, or the Mac wasn't removed from the school's system when they got rid of it.

You'll most likely have to contact the school district with your serial number and see if they're willing to remove it from their MDM/DEP system.

It was not stolen or repaired. It came from a retailer who shut up shop a few years ago. When I m doing video work on it, it is usually disconnected from the internet to avoid interruptions, the popup is not a big deal, all I do is close it when it opens.

Maybe I can get my antivirus program to block it if it is coming over the internet. I know I can do similar on my Windows gear, but I am not that familiar with the finer points and inner workings of the Mac OS. Any suggestions?

I'll see if I can track down the school system, although one would expect them to keep their house in order. They are not setting a good example for their students.

 

[tsialex]

I don't think this is related to DEP Automated Device Enrollment, since it's a MacPro5,1, but could be a MDM profile embedded in the firmware. A easy way to confirm or disprove is doing a clean install to an erased disk and see if the pop-up appears again.

You can also send me a BootROM image dump, or a better yet a full DarwinDumper, and I can investigate what is really going on.

 

[tsialex]

BTW, it's not coming from the internet. It's a Management Profile that was installed by someone or by an app, or was embedded inside the BootROM by the original owner of the Mac. It's already in your Mac, in one way or another.

 

[trixman]

I don't think this is related to DEP Automated Device Enrollment, since it's a MacPro5,1, but could be a MDM profile embedded in the firmware. A easy way to confirm or disprove is doing a clean install to an erased disk and see if the pop-up appears again.

You can also send me a BootROM image dump, or a better yet a full DarwinDumper, and I can investigate what is really going on.

Thanks, but I will not be able to get to your request until Thursday at the earliest. Tomorrow is therapy day and Wednesday is Neurologist.
I just tried to download DarwinDumper from Softpedia but it will not open as it is not apple approved !!!!!! What the Heck!

OK, I can discount the internet then.

 

[tsialex]

Official bitbucket repository for DarwinDumper:

blackosx / DarwinDumper / Downloads — Bitbucket

bitbucket.org

You will need to disable SIP to run it and get everything.

 

[trixman]

I don't think this is related to DEP Automated Device Enrollment, since it's a MacPro5,1, but could be a MDM profile embedded in the firmware. A easy way to confirm or disprove is doing a clean install to an erased disk and see if the pop-up appears again.

You can also send me a BootROM image dump, or a better yet a full DarwinDumper, and I can investigate what is really going on.

I did manage to find the time to get a copy of DarwinDumper downloaded and installed.

 

[tsialex]

I did manage to find the time to get a copy of DarwinDumper downloaded and installed. Here are the results, I hope they are what you want.

This is just the log. Do the full dumper and send me the complete zip file by PM, there are serial numbers and contact info inside.

 

[trixman]

It seems the HTM file did not come through. How can I get it to you?

 

[tsialex]

It seems the HTM file did not come through. How can I get it to you?

Send me the zip file, it will be saved where SavePath is pointing, not the html one. Don't forget to click on SelectAllDumps:

 

[trixman]

Did it come through in the conversation?

 

[tsialex]

Did it come through in the conversation?

Yes, but the html file is not enough, also you didn't boot Recovery to disable SIP, it's enabled and with SIP enabled you DarwinDumper can't dump the BootROM image.

 

[trixman]

Hello again, I apologize for not posting for a number of days, I was unavailable at short notice.
Now I need to figure out how to turn off SIP, I am not a Mac person, I'm mostly Microsoft to this point in my life.

 

[tsialex]

Now I need to figure out how to turn off SIP, I am not a Mac person, I'm mostly Microsoft to this point in my life.

Disabling and Enabling System Integrity Protection | Apple Developer Documentation

Disable system protections only temporarily during development to test drivers, kernel extensions, and other low-level code.

developer.apple.com

 

[trixman]

Here is where I am. I started the Mac in recovery mode and selected Disk Utility. I cannot find any way to launch Terminal. I cannot find a selection in the Disk Utility window or in the Menu Bar.

 

[tsialex]

Here is where I am. I started the Mac in recovery mode and selected Disk Utility. I cannot find any way to launch Terminal. I cannot find a selection in the Disk Utility window or in the Menu Bar.

Just boot Recovery, select the Language (if Recovery asks), then Terminal is on the Menu/Utilities:

 

[trixman]

Hmmm... your menu is different to mine. Is there another way to open Terminal, a keyboard shortcut maybe?

 

[tsialex]

Hmmm... your menu is different to mine.

Please close DiskUtility.

 

[flat4]

.

 

[trixman]

I restarted the Mac so I am back to the normal desktop etc.

 

[tsialex]

I restarted the Mac so I am back to the normal desktop etc.

Did you quit DiskUtility, opened Terminal and finally disabled SIP with csrutil disable?

 

[trixman]

I did close Disk Utility but there was no way I could find to open Terminal in Disk Utility. There was no menu selection for anything even close to it. Is there another way to open Terminal, a keyboard shortcut maybe?

I clicked on everything in the menu. It is a mystery to me. This reminds me of microshite, every time they do a minor update, they change something but don't tell anyone.

 

[flat4]

its not in disk utility
quit it

then it will say macOS and the menu utilites