# MDM / School Lock Removal (offline, from SystemRescue)

## Why offline removal

School/enterprise laptops often have MDM (Mobile Device Management) software that displays a lock message at the Windows login screen and prevents login even with valid credentials. Common messages:
- "This laptop has been locked. Please return."
- "This device is managed by your school/company."
- Custom legal notice or activation screen.

When the SAM has been cleared (blank passwords) but the login screen still blocks access with a custom message, it's likely an **MDM or custom application lock** rather than a password issue.

## Prerequisites

```bash
# Boot target into SystemRescue
# Mount Windows partition (usually sda2 for data, or sda3 for OS)
mount /dev/sda2 /mnt
```

## Step 1: Identify the lock mechanism

### 1a. Check registry Run keys for startup programs
```bash
reged -x /mnt/Windows/System32/config/SOFTWARE \
  "HKEY_LOCAL_MACHINE\SOFTWARE" \
  "\Microsoft\Windows\CurrentVersion\Run" /tmp/run.txt
cat /tmp/run.txt
```
Look for suspicious entries like `K12Activation`, `k12versiontray`, `school`, `mdm`, `lock`, `manage`.

### 1b. Check MDM enrollment
```bash
reged -x /mnt/Windows/System32/config/SOFTWARE \
  "HKEY_LOCAL_MACHINE\SOFTWARE" \
  "\Microsoft\Enrollments" /tmp/enroll.txt 2>&1 | grep -c "HKEY"
```
25+ subkeys under Enrollments = active MDM enrollment.

### 1c. Search for known K12/MDM files
```bash
find /mnt/Program\ Files /mnt/Program\ Files\ \(x86\) /mnt/ProgramData \
  -maxdepth 3 -name "*k12*" -o -name "*activation*" -o -name "*mdm*" \
  2>/dev/null | head -20
```

### 1d. Check for custom legal notice in registry
```bash
reged -x /mnt/Windows/System32/config/SOFTWARE \
  "HKEY_LOCAL_MACHINE\SOFTWARE" \
  "\Microsoft\Windows NT\CurrentVersion\Winlogon" /tmp/winlogon.txt
grep -i "legal\|caption\|notice" /tmp/winlogon.txt
```

## Step 2: Remove the lock

### 2a. Remove startup entries pointing to lock software
```bash
cat > /tmp/remove_lock.reg << 'EOF'
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"activation"=-
"k12versiontray"=-
EOF

reged -C -I /mnt/Windows/System32/config/SOFTWARE \
  "HKEY_LOCAL_MACHINE\SOFTWARE" /tmp/remove_lock.reg
```

### 2b. Remove MDM enrollment (if present)
```bash
# Delete Enrollments key — may need to remove subkeys first if it has many
echo -e "cd Microsoft\ndk Enrollments\ny\nq" | \
  chntpw -e /mnt/Windows/System32/config/SOFTWARE 2>&1 | grep -E "deleted|Error"
```

### 2c. Rename the K12 program folder (disables all K12 software)
```bash
mv /mnt/k12 /mnt/k12.BAK
```

## Step 3: Verify removal
```bash
reged -x /mnt/Windows/System32/config/SOFTWARE \
  "HKEY_LOCAL_MACHINE\SOFTWARE" \
  "\Microsoft\Windows\CurrentVersion\Run" /tmp/run2.txt
grep -i "k12\|activation\|mdm\|school" /tmp/run2.txt || echo "Clean"
```

## Common K12 software patterns observed

| Component | Path | Purpose |
|---|---|---|
| K12Activation.exe | `C:\k12\Software\run\` | Shows lock/activation screen at login |
| K12VersionTray.exe | `C:\k12\Software\run\` | System tray management icon |
| ApplicationManager.exe | `C:\k12\CDW_K12ApplicationManager\` | Java-based app distribution |
| CloseAll.exe | `C:\k12\CloseAll\` | Close all running apps (not lock-related) |
| Logo image | `C:\ProgramData\k12_logo-desktop.png` | School logo shown on lock screen |

## If lock persists after removal

- **McAfee device control** may have a separate lock mechanism in its service config
- **Group Policy** may cache locks in `C:\Windows\System32\GroupPolicy\`
- Machine may have an **Intune/Jamf BIOS lock** that can't be removed offline
- Try **utilman.exe trick** to get SYSTEM cmd at login, then check running processes