Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

If a MacOS device is locked; is there a way to wipe it *without* unlocking it?

<@U09JY60H14Z> what do you mean "in a state to receive the command"?

As far as I understand a locked device cannot receive commands?

<@UACLMRSFJ> that requires a wired connection to another mac right?

Context: we have an ex-employee who's laptop was locked. He's negotiated with HR to keep the laptop. Now we need to wipe+release it to him.

<@UACLMRSFJ> so he'd need to DFU it; and we'd also need to release from ABM right?

I also doubt this person has a 2nd mac lying around; and it doesn't really make for a repeatable process :confused:

I haven't tried wiping after locking as <@U09JY60H14Z> suggests. Do you see any activity in Fleet for the device? Maybe ask the user to put it on ethernet?

I've got a practice device locally here that I'm practicing on

Once the lock is done, the laptop restarts and just shows a screen asking for a pin code

I'm pretty sure it's not connecting to wifi or otherwise communicating with the outside world

This would appear to be an apple limitation....

Is it Apple Silicon? I believe AS devices remain online to some degree even if powered off now.

I'm not sure if that applies to MDM communication.

yes; or at least the device I'm practicing on is

How would it remain online? In the unlock screen it presents there's no sign of a network connection option....
And then at least for where I am, there's no other way to get to the internet lol

one sec I can easily verify that in the wifi AP logs

That's why I suggested ethernet. I know phones and watches stay online for FindMy.

<@U06FS72M2EB> as you've both established, I meant that it had an active network connection. If the device has been powered off or restarted since receiving the lock command, it *will not* reconnect to Wi-Fi automatically until it has been unlocked. Using ethernet should resolve that.

Once it's online, it should receive the queued up MDM commands.

<@U09JY60H14Z> when you lock a macos device they poweroff/restart almost instantly; or at least as soon as the laptop has an internet connection. (and then progress from Lock Pending to Locked in the fleet UI)
i.e. if a mac device has "locked" in the fleet UI you already know it's been restarted