Disabling the Erase All Contents and Settings function on macOS Monterey
As part of macOS Monterey, Apple has introduced the Erase All Contents and Settings function to macOS for Apple Silicon Macs. In my Monterey testing, this setting was very useful because it enabled me to reset my Mac to a factory default condition without having to spend extra time wiping the drive and installing a fresh copy of macOS.
However, having this functionality available may not desired in all environments. For Mac admins supporting these environments, Apple has provided a new profile management option, as part of the Restrictions payload, which disables the Erase All Contents and Settings functionality on Apple Silicon Macs.
For more details, please see below the jump.
I’ve written a profile to disable Erase All Contents and Settings functionality which does the following:
1. Removes the Erase All Contents and Settings… menu option from the System Preferences option.
2. Blocks the Erase Assistant app from running.
Note: When the profile is installed, the Erase Assistant app will show the following message:
Erase Assistant is not supported on this Mac.
In order to apply this profile, there are some pre-requisites:
- User Approved Mobile Device Management (UAMDM) must be enabled on the target Mac.
- Profile must be installed by an MDM server.
Those pre-requisites also apply to deploying this profile, which is available via the link below:
https://github.com/rtrouton/profiles/tree/main/DisableEraseAllContentsAndSettings
When deployed, the profile should appear similar to this in System Preference’s Profiles preference pane.
Leave a comment
Recent Comments
 | Ben LeRoy on Losing a giant |
 | Peter-Erik on Downloading installer packages… |
 | nathanhaggard on Losing a giant |
 | andras0602 on Disabling login window clock d… |
 | Jeff on Losing a giant |
Der Flounder 
When uploading this mobileconfig to Jamf… what Preference domain should be used? I’m guessing com.apple.systempreferences ?
Hi @damacguy – we are using ‘com.apple.applicationaccess’
HTH
It’s not only available for Silicon Devices but also for Apple T2 Security Chip https://support.apple.com/en-us/HT212749
In my case i decide to not disable this feature.
https://macos.it-profs.de/macos-monterey-erase-all-content-and-settings-for-companies/
I suppose it’s also possible to block this app: /System/Library/CoreServices/Erase\ Assistant.app/
Wondering if that is a better way (using Jamf)?
Is I my default an admin only presence. Any way to limit to a group?
Hey Rich! When you create these, do you use a tool, or do you just go raw text and randomly generate the ID strings on the fly, like with uuidgen or something like that?
Here’s three tools I use:
ProfileCreator: https://github.com/ProfileCreator/ProfileCreator
iMazing Profile Editor: https://imazing.com/profile-editor
profiletool: https://github.com/scriptingosx/profiletool
So how do you remove this when you’re ready to use the erase assistant?