How to Check a Used MacBook Before Buying (Find My, MDM, Serial)

A used MacBook can save you hundreds — but Macs carry locks that phones don’t. Besides Activation Lock, many MacBooks on the second-hand market were once company laptops enrolled in device management. They look perfect, erase cleanly, and then show a “Remote Management” screen the moment you set them up on Wi-Fi.

The fix is a fifteen-minute inspection. You’ll check the serial number, Find My, MDM enrollment, encryption and battery — partly through menus and partly with a few Terminal commands that tell you more than any seller will.

Step 1: Get and verify the serial number

Click the Apple menu › About This Mac. The window shows the model name, chip, memory and serial number. You can also find it in System Settings › General › About, and printed underneath the MacBook near the hinge.

All three must match. Then confirm the model is what the listing claims. MacBooks made before 2021 have 12-character serials that encode the factory and manufacture week; newer models use a randomized 10-character serial. Paste an older serial into the decoder below to see what it reveals:

For any serial, a Mac part number check returns the exact configuration. More on serial formats in our guide to decoding Apple serial numbers, or use the Mac serial check page.

Step 2: Confirm Find My and Activation Lock are off

Macs with Apple silicon or the Apple T2 Security Chip support Activation Lock. If the previous owner leaves Find My on, the Mac asks for their Apple ID after an erase or reinstall, and you can’t get past it.

• Open System Settings, click the owner’s name at the top, then iCloud, and check that Find My Mac is off. Better: the seller should sign out of their Apple ID completely.
• Check remotely before you meet with the MacBook Find My On/Off check.
• For a theft check, the MacBook iCloud clean/lost check shows whether the Mac is marked lost.

Step 3: Check for MDM and company enrollment

Organizations register Macs in Apple Business Manager or Apple School Manager. That registration lives on Apple’s servers, not on the disk, so erasing the Mac does not remove it. Only the organization can release the device.

In System Settings, look for installed profiles under General › Device Management (on macOS Ventura it’s Privacy & Security › Profiles). A personal Mac shows nothing there. But a freshly erased Mac won’t show profiles either, so also run a check by serial with the MDM status check. Read more about how this lock works in what is an MDM lock.

Step 4: Run these Terminal commands

Open Terminal (Applications › Utilities › Terminal, or press Command-Space and type “Terminal”). Run each command and read the output:

system_profiler SPHardwareDataType
sudo profiles status -type enrollment
sudo profiles show -type enrollment
fdesetup status
system_profiler SPPowerDataType | grep -i "cycle count"

What the results mean

• system_profiler SPHardwareDataType — shows model name, model identifier, chip, memory, serial number and, on Apple silicon and T2 Macs, Activation Lock Status. You want “Disabled”. Check the serial matches the box and the listing.
• sudo profiles status -type enrollment — asks for the admin password, then shows Enrolled via DEP and MDM enrollment. Both should say No. “Yes” means the Mac belongs to an organization.
• sudo profiles show -type enrollment — asks Apple whether the Mac has a device-enrollment record. If it returns organization details, the Mac is registered to a company or school, even if it isn’t enrolled right now.
• fdesetup status — reports whether FileVault disk encryption is on. If it’s on, the seller should turn it off or erase the Mac so you don’t inherit their encryption key.
• system_profiler SPPowerDataType | grep -i "cycle count" — shows the battery cycle count.

Step 5: Battery, display and hardware test

Battery

Go to System Settings › Battery and click the info button next to Battery Health. “Normal” is good; “Service Recommended” means you should budget for a replacement. Compare the cycle count from Terminal: Apple rates most modern MacBook batteries for 1,000 cycles.

Display and keyboard

• Open a full-screen white and then black image. Look for dead pixels, bright spots, and stains or worn coating on the screen.
• Open TextEdit and type every key, including function keys and Touch ID (enroll a fingerprint, test it, then delete it).
• Test the trackpad click across the whole surface.

Ports, audio and camera

Charge from each USB-C or MagSafe port, play audio through the speakers, open Photo Booth to test the camera and microphone, and connect to Wi-Fi and Bluetooth.

Storage and specs

In About This Mac, click More Info (or System Report) and confirm the chip, memory and storage match the listing. Upgrades are impossible on modern MacBooks because memory and storage are soldered, so a “16 GB upgraded” claim on an Apple silicon model is simply wrong. Check that the startup disk shows the full expected capacity in System Settings › General › Storage.

Apple Diagnostics

On Apple silicon, shut down, then press and hold the power button until startup options appear, and press Command-D. On Intel Macs, restart and hold D. Apple Diagnostics runs a hardware test and gives reference codes if anything fails.

Step 6: Confirm the history with Apple’s records

For an expensive MacBook, it’s worth seeing the full record. The Apple full GSX report shows the sold-by details, purchase date, repair cases, replacement history and activation policy. It’s the best way to confirm a “new” or “barely used” MacBook really is.

Step 7: Watch the seller erase it

On Macs with Apple silicon or T2 chip running macOS Monterey or later, the seller should go to System Settings › General › Transfer or Reset › Erase All Content and Settings. It signs out of Apple ID, turns off Find My and wipes the data. The Mac restarts to the setup assistant.

Before paying, connect to Wi-Fi during setup. If you see a Remote Management screen naming an organization, stop — that’s MDM enrollment. If setup asks for someone’s Apple ID, Activation Lock is still on. Only pay when you reach your own desktop.

Run the remaining checks by serial here: