Jamf Lock Pin Missing

[ntavassoli]

One of our agents locked a macbook via the remote lock command from Jamf Pro and did not record the pin.  One of our other agents then deleted the macbook out of jamf before releasing the lock. Now we have a bricked macbook that we have no way of getting into since we dont have reord of what the pin could be.

We are back and forth between Jamf support and Apple support to get this resolved.  Jamf says they cant do anything and Apple is saying it's on Jamf to remove the lock.

Any help here would be appreciated. 

[AJPinto · Accepted solution]

Jamf does not record the lock pin either way, its up to you to escrow it. 

The mac is not a brick, just connect it to another mac with Apple Configurator and perform a DFU restore. If that is not an option, take it to an Apple Store with proof of purchase and they can DFU restore it.

[ntavassoli]

I discovered the device i was running on Apple configurator was the root of the issue. Apparently it was too low on storage.  This caused the "The operation couldn’t be completed. No space left on device [NSPOSIXErrorDomain – 0x1C (28)]" error.

DFU Restore for the win, thank you gentlemen @Tribruin @AJPinto 

[AJPinto]

That will do it, I'm glad you got things sorted out. Cheers!!!

[ntavassoli]

When attempting to do DFU restore, I get this message:

The operation couldn’t be completed. No space left on device [NSPOSIXErrorDomain – 0x1C (28)]

Spoke with multiple Apple Reps and they stated since this is deployed by the MDM it fall onto them to resolve this issue.  They cant do anything to help here.

[AJPinto]

The device is in a state where the MDM cannot interact with it, and you are needing assistance with reviving the device which has nothing to do with MDM and something Apple will assist with. The [NSPOSIXErrorDomain – 0x1C (28)] error also nothing to do with MDM, I recommend telling apple you want a diagnostics run on the device. They will need to revive it themselves before being able to run the diagnostics, and these diagnostics are free.

DFU mode does not care about available disk space as it formats the disk, and the IPSW is downloaded to the device with Apple Configurator before anything happens. Just to be sure, in Apple Configurator does the device show up with DFU over the icon?

https://support.apple.com/en-us/108900

[ntavassoli]

Yes. The device shows up with DFU over the icon. I begin the restore process and then get hit that error code. Tried reviving as well and get the same error.  Apple phone support said all they would try doing is DFU restore onsite.

Been told multiple times that DFU restore wont work even if it goes through.  I also ran this whole scenario through chatgpt and it came up with this conclusion (would love to prove it wrong).

"DFU restore doesn’t work because the Secure Enclave lock (Remote Lock PIN) persists independently of the operating system or firmware, and blocks all erase or restore attempts until the correct PIN is entered or the logic board is replaced"

[Tribruin]

Just to confirm, you used the Remote Lock command in Jamf and it is a six digit code that is being requested?

Is this Apple Silicon or Intel?

I can confirm that doing a DFU restore on an Apple Silicon computer is enough. I have done it personally and walked my deskside support team through the process several times. So, like AJPInto says, if DFU is not working, there is something else going on with that Mac. 

[ntavassoli]

Yes, this is for the Remote Lock command in Jamf and it is a six digit code that is being requested. Yes, Apple Silicon. (M2 Macbook Air)

The error code is referring to the storage on the locked macbook.  Here's more info from ChatGPT if you are curious:

The DFU restore failed because the device had a Remote Lock with a 6-digit PIN issued via Jamf Pro (MDM). Here's why that blocks restoration:

---

1. Remote Lock PIN Is Stored in the Secure Enclave

• When a Remote Lock is issued via Jamf with a PIN, that PIN is stored inside the Secure Enclave on the Mac’s logic board.

• This lock is hardware-enforced and not tied to the operating system, disk, or firmware.

• Once active, the device cannot boot or accept any reinstallation without the correct PIN.

---

2. DFU Restore Can’t Override Secure Enclave Locks

DFU Restore (Device Firmware Update):

• Wipes and reinstalls macOS, firmware, and recoveryOS

• But does not erase or reset the Secure Enclave

As a result:

• Even after DFU restore, the Secure Enclave enforces the PIN lock

• Any attempt to write to locked system partitions fails

---

3. Error Code Confirms It

The failure during restore showed this error:

csharp

CopyEdit

The operation couldn’t be completed. No space left on device [NSPOSIXErrorDomain – 0x1C (28)]

This happens because:

• The Secure Enclave prevents APFS volumes from mounting

• Apple Configurator (or cfgutil) cannot partition or write to system volumes

• It's a low-level access denial, not an actual storage capacity issue

DFU restore doesn’t work because the Secure Enclave lock (Remote Lock PIN) persists independently of the operating system or firmware, and blocks all erase or restore attempts until the correct PIN is entered or the logic board is replaced.

[Tribruin]

Did ChatGPT cite its sources? ChatGPT is good at many things, but it can be wrong. 

All I can say is that I have done this MANY times, so I will take my personal experience over ChatGPT. 

[ntavassoli]

❌ Why DFU Restore Doesn’t Remove MDM Remote Lock PIN

🔐 1. Remote Lock PIN Is Stored in the Secure Enclave

When a Remote Lock command is issued via MDM (Mobile Device Management), such as Jamf Pro, the six-digit PIN is stored within the device's Secure Enclave. This hardware component is part of the logic board and is designed to securely manage sensitive information. As a result:

• The lock is hardware-enforced and persists independently of the operating system or firmware.

• Standard software-based methods, including DFU restores, cannot remove this lock.

Source: Lock and locate Apple devices – Apple Support

---

🧱 2. DFU Restore Doesn’t Reset the Secure Enclave

A DFU restore reinstalls the firmware and operating system but does not affect the Secure Enclave. Therefore:

• The Remote Lock PIN remains intact after a DFU restore.

• The device continues to prompt for the PIN upon startup, rendering the restore ineffective in removing the lock.

Source: Revive or restore a Mac with Apple silicon using Apple Configurator – Apple Support

---

📛 3. Error Code Indicates Secure Enclave Enforcement

During a DFU restore attempt, you might encounter the following error:

csharp

CopyEdit

The operation couldn’t be completed. No space left on device [NSPOSIXErrorDomain – 0x1C (28)]

This error suggests that the Secure Enclave is preventing access to necessary system partitions, not that the device's storage is full.

Source: M1 mini bricked w code NSPOSIXErrorDomain – Apple Community

---

✅ Resolution: Logic Board Replacement

Since the Secure Enclave is integral to the logic board, replacing the logic board effectively removes the stored Remote Lock PIN. This process:

• Installs a new Secure Enclave without the previous lock.

• Allows the device to boot normally and be set up anew.

Note: Ensure that the device is unassigned from MDM in Apple Business Manager before service to prevent re-enrollment issues.

Source: Clearing MDM lock on Apple Silicon Macs when passcode has been lost – Der Flounder

[snowfox]

I asked ChatGPT the same thing and it told me the complete opposite info in its answer.  Always turn on memory when working with ChatGPT and tell it to always cite its sources when replying to you and save that request to its memory for future chats.  Also tell it not to guess or make it up if it doesn't know the answer.

I had a very interesting conversation with it one night, it told me it had been programmed to make up the answer and sound confident while doing so by its creators, if it didn't know the answer.  I nearly fell off my chair when I read it.  If it doesn't know the answer, it effectively lies and sounds confident while doing so to make it sound good.  I kid you not.  Since then I always get it to cite its sources for review.

This was my question:

On Apple Macs, does DFU restore reset the Secure Enclave chip status or the content stored there in?

This was its reply to me:

On Apple Macs with a T2 chip or Apple Silicon (M1, M2, M3, etc.), performing a DFU restore (Device Firmware Update) using Apple Configurator does reset the Secure Enclave, but with important caveats depending on the type of Mac:

---

✅

1. What a DFU Restore Does (Generally)

:

A DFU restore completely wipes and reinstalls:

• Firmware

• macOS recovery

• macOS system

• Secure Enclave Processor (SEP) firmware and data

It returns the Mac to factory state, including:

• Erasing internal storage (SSD)

• Resetting NVRAM

• Erasing Secure Enclave content

💾

2. Secure Enclave Reset – What Gets Erased?

When you perform a full DFU restore:

• The Secure Enclave is erased and re-initialized.

• All data protected by the SEP, including:

  • Touch ID fingerprints

  • FileVault encryption keys

  • Keychain passwords

  • Activation Lock state (unless linked to Apple ID)

• This means user data protected by Secure Enclave becomes unrecoverable after a DFU restore.

---

🔐

3. But What About Activation Lock?

Activation Lock (Find My Mac) is not removed by DFU restore alone.

• The Apple ID lock status is stored on Apple’s servers, not just in the Secure Enclave.

• So even after DFU restore, the Mac will ask for the original Apple ID and password during setup.

• You need to manually remove Activation Lock via iCloud or with proof of ownership.

---

💡

In Summary

:

Aspect	DFU Restore Effect
SEP firmware	✅ Reinstalled
SEP data (e.g. keys, Touch ID)	✅ Erased
FileVault keys	✅ Erased
Keychain items	✅ Erased
Activation Lock	❌ Not removed

---

🛠️ Use Case:

If you’re re-provisioning a T2 or Apple Silicon Mac, DFU restore is the most complete wipe available. But you must remove the Apple ID account from Find My beforehand, or the device will stay iCloud locked.

Would you like a step-by-step DFU guide for a specific Mac model?