The Challenge of Corporate Device Management
If you buy a MacBook for personal use, you have absolute freedom to change the desktop wallpaper, disable the firewall, or install any software you want. However, if you are an employee at a massive corporation and you are handed a company-owned MacBook, IT administrators cannot allow you to have that much freedom. They need to ensure the firewall is permanently locked on, the corporate VPN settings are pre-configured, and certain dangerous applications are blocked.
To enforce these strict corporate rules across thousands of Macs simultaneously, IT departments use Mobile Device Management (MDM) software to push “Configuration Profiles” to the laptops over the internet. These profiles are essentially digital rulebooks that silently overwrite the user’s graphical System Settings.
If you are an IT support technician troubleshooting a Mac that is suddenly failing to connect to the corporate Wi-Fi, the graphical interface will often hide the true cause of the problem. To instantly view, install, or delete these strict corporate rulebooks directly from the command line, you must use the profiles command.
Step 1: Open the Terminal
Because you are interacting with system-level security policies, almost every profiles command requires root administrator privileges.
- Press Command + Space to open Spotlight Search.
- Type
Terminaland press Enter.
Step 2: Listing Installed Profiles
The first step in troubleshooting a restricted Mac is seeing exactly what rules are currently being enforced on the machine.
To generate a list of every active configuration profile, use the show argument.
sudo profiles show
The terminal will output a list of installed profiles, grouped by whether they apply to the entire machine (System) or just the specific user logged in (User). Each profile will display its human-readable name (e.g., Corporate VPN Configuration) and its unique mathematical identifier (e.g., com.company.vpn.profile).
Step 3: Viewing Specific Profile Details
If a user complains that they cannot access a specific internal website while connected to the VPN, you need to see exactly what network settings the VPN profile is injecting into the Mac.
You can force the command to dump the raw XML code of a specific profile by adding the -type flag.
sudo profiles show -type configuration
The terminal will output a massive block of raw code. By scanning this code, you can instantly see if the IT department accidentally pushed a profile containing the wrong VPN server address, proving the problem is with the corporate network, not the user’s laptop.
Step 4: Installing a Profile Manually
Usually, profiles are pushed automatically over the internet by MDM servers. However, if you are testing a brand new Wi-Fi configuration before deploying it to the entire company, you will likely have the raw .mobileconfig file sitting on your Desktop.
To manually inject that test profile into your Mac, use the install argument and specify the exact file path using the -path flag.
sudo profiles install -path ~/Desktop/test_wifi.mobileconfig
The terminal will execute the installation instantly, locking the new Wi-Fi settings into the operating system.
Step 5: Deleting a Corrupted Profile
If a corrupted profile is causing the Mac’s networking stack to crash, the quickest way to fix the computer is to simply delete the rulebook and let the Mac request a fresh copy from the corporate server.
To delete a profile, you use the remove argument, followed by the unique identifier you found in Step 2 using the -identifier flag.
sudo profiles remove -identifier com.company.vpn.profile
The moment you press Enter, the restrictions are instantly lifted, the corrupted settings are wiped from the Mac, and normal functionality is restored.