Mac Terminal Commands to Check Serial Number, Model and MDM Status

A used MacBook can look spotless in the listing and still be enrolled in a company’s device management, locked to someone else’s Apple Account, or a completely different model from the one advertised. The quickest way to see the truth is the built-in Terminal app: a handful of commands read the serial number straight from the hardware and report exactly how the Mac is configured.

Everything below is read-only — none of these commands change anything on the Mac — so you can run them on a seller’s machine without risk. Open Terminal from Applications › Utilities › Terminal, or search for it with Spotlight.

Serial number, model and chip

system_profiler SPHardwareDataType

This prints the hardware overview: Model Name (for example MacBook Pro), Model Identifier (such as MacBookPro18,3 or Mac14,2), Chip or Processor, Memory, Serial Number and Hardware UUID. On Macs with Apple silicon or the T2 chip it also shows Activation Lock Status — you want Disabled.

Prefer a single value? These read the serial directly from the I/O registry and the model identifier and chip from the kernel:

ioreg -l | grep IOPlatformSerialNumber
ioreg -rd1 -c IOPlatformExpertDevice | grep IOPlatformSerialNumber
sysctl -n hw.model
sysctl -n machdep.cpu.brand_string

The serial from Terminal is the one burned into the logic board. Compare it with the serial on the bottom case, the box and the listing — a mismatch can mean a replaced board or a swapped case. You can decode older 12-character serials right here (or read how to decode an Apple serial number):

macOS version

sw_vers

You’ll get ProductName, ProductVersion (for example 15.x) and BuildVersion. Check that the version is supported for the model, and be wary of a Mac running a very old macOS “because updates break it” — sometimes that’s a sign of an MDM or Activation Lock problem the seller wants to hide.

MDM and Device Enrollment status

This is the most important check on any Mac that might have belonged to a company or school. Managed Macs can be locked, wiped or reconfigured remotely, and Macs registered in Apple Business Manager or Apple School Manager will show a Remote Management screen after every erase.

sudo profiles status -type enrollment
sudo profiles show -type enrollment
sudo profiles list

Type your administrator password when asked (nothing appears while you type — that’s normal).

• profiles status -type enrollment answers two questions. Enrolled via DEP: No and MDM enrollment: No is what you want on a personal Mac. MDM enrollment: Yes (often with “User Approved”) means it is currently managed.
• profiles show -type enrollment asks Apple’s servers whether this serial number has an automated device enrollment configuration. A normal personal Mac returns an error such as “Client is not DEP enabled”. If it returns a configuration with an organization name, the Mac is registered to that organization and will rejoin management after a reset. This one needs an internet connection.
• profiles list shows any configuration profiles installed in the system. On a clean Mac there should be none.

Confirm with an official MDM status check using the serial — it reads the record even if the Mac has been wiped. Our MDM check page explains the results.

FileVault, SIP and firmware password

fdesetup status
csrutil status
sudo firmwarepasswd -check

• fdesetup status — FileVault is On. means the disk is encrypted. That’s good for security, but make sure the seller erases the Mac and that you know who holds the recovery key while you own it.
• csrutil status — System Integrity Protection status: enabled. is the normal state. disabled means someone deliberately turned off a core macOS protection, which is unusual on a consumer Mac and sometimes linked to bypass attempts.
• firmwarepasswd -check — Intel Macs only. Password Enabled: Yes means you won’t be able to boot from other disks or Recovery without it. Apple silicon Macs don’t use this command.

Battery health on MacBooks

system_profiler SPPowerDataType | grep -i -E "cycle count|condition|maximum capacity"

Look for Cycle Count, Condition (Normal or Service Recommended) and, on recent macOS versions, Maximum Capacity. Apple publishes the rated cycle count for each model on its support site; most recent MacBooks are rated for 1,000 cycles.

Find My and Activation Lock: check from both sides

Terminal shows Activation Lock status on supported Macs, but double-check two ways:

1. On the Mac: System Settings › [name] › iCloud — the seller should sign out of their Apple Account completely, which turns off Find My Mac.
2. Run a MacBook Find My (FMI) check and a MacBook iCloud clean/lost check on the serial number. These read Apple’s records, so they still work after the Mac has been erased.

Then ask the seller to use Erase All Content and Settings (System Settings › General › Transfer or Reset) in front of you. A clean Mac restarts to the setup assistant without asking for anyone’s Apple Account and without a Remote Management screen.

Reading the results: common scenarios

A one-minute checklist

• Serial in Terminal = serial on the case and box.
• Model and chip match the listing.
• MDM enrollment: No, Enrolled via DEP: No, no installed profiles.
• Activation Lock disabled and Find My off after sign-out.
• Battery condition Normal with a reasonable cycle count.

For the full hands-on inspection, follow our used MacBook buying checklist and run the Mac serial check: