mdmclient

executablemacOS4.6 MBx86_64, arm64

System security and credential management daemon — authenticates users and manages encryption keys

Manages user authentication through Touch ID, Face ID, and passwords, and handles Apple ID verification. Accesses and controls Secure Enclave-sealed keys and system keychain items for credential storage and encryption operations. Drives Bluetooth and Wi-Fi hardware, applies MDM configuration profiles, and submits analytics to Apple. Exposes 23 XPC services for system components to request authentication, key access, and security operations. Communicates with 23 network endpoints, likely for Apple ID verification and MDM policy retrieval.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 4.6 MB
UUID: 0E40A809-F215-3441-883D-714466472C99
Analyzed: 2026-04-09T09:55:04Z
CDHash: f7f9c06b9ad30a54d54ace195269cda515b4c66268f1c5c5b59b57945b066e86

Capabilities

KeychainRead and use keychain encryption keys

com.apple.keystore.access-keychain-keys [object Object]

KeychainAccess Secure Enclave sealed keys (SIK)

com.apple.keystore.sik.access [object Object]

KeychainRead and write system keychain items

com.apple.private.system-keychain [object Object]

KeychainKeychain access group membership

keychain-access-groups

ConfigurationProfiles apple appleaccount com.apple.identities com.apple.certificates com.apple.mdm.attestation com.apple.narrative.client lockdown-identities

NetworkNetwork configuration and reachability

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

StoragePrivate storage area access

com.apple.private.security.storage.ConfigurationProfilesPrivate [object Object]

HardwareBluetooth LE device access

/System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetooth

HardwareWiFi interface control

/System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLAN

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

SecurityTouch ID / Face ID / password auth

/System/Library/Frameworks/LocalAuthentication.framework/Versions/A/LocalAuthentication

SecurityApple ID authentication

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/AuthKit

SecuritySecurity framework extensions

/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

SystemBackground task scheduling

/System/Library/PrivateFrameworks/BackgroundSystemTasks.framework/Versions/A/BackgroundSystemTasks

SystemMDM configuration profiles

/System/Library/PrivateFrameworks/ConfigurationProfiles.framework/Versions/A/ConfigurationProfiles

Frameworks75

libmis.dylib libMobileGestalt.dylib BackgroundSystemTasks DMCTools CoreBluetooth AVFoundation AVRouting MessageSecurity CoreTime libutil.dylib SetupAssistantFramework AppAttestInternal CoreFollowUp DEPClientLibrary MobileActivationMacOS AppleIDSSOAuthentication RecoveryOS AppleMediaServices DMCUtilities DMCEnrollmentLibrary SystemPolicy MobileInstallation libbootpolicy.dylib libDiagnosticMessagesClient.dylib UserNotifications LocalAuthentication AppStoreDaemon DiskArbitration DiskManagement AppStoreFoundation RemoteServiceDiscovery OSUpdate CoreAnalytics FindMyDevice libIASUnifiedProgress.dylib libCoreStorage.dylib libcsfde.dylib EFILogin Accounts AuthKit SecurityInterface ApplePushService CoreWLAN login UserManagement acfs CoreServices SecurityFoundation SystemConfiguration AudioToolbox SystemAdministration ConfigurationProfiles CoreGraphics ServiceManagement IOKit UniformTypeIdentifiers DeviceIdentity MDMClientLibrary OpenDirectory FindMyMac Security ManagedClient Foundation libobjc.A.dylib libc++.1.dylib libSystem.B.dylib CoreFoundation SoftLinking libswiftCore.dylib libswiftCoreFoundation.dylib(weak)libswiftDispatch.dylib(weak)libswiftIOKit.dylib(weak)libswiftObjectiveC.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)

Entitlements75

com.apple.ManagedClient.cloudconfigurationd-accesstrue

com.apple.accounts.inactive.fullaccesstrue

com.apple.appattest.spitrue

com.apple.avfoundation.allow-system-wide-contexttrue

com.apple.avfoundation.allows-access-to-device-listtrue

com.apple.avfoundation.allows-set-output-devicetrue

com.apple.bluetooth.systemtrue

com.apple.duet.activityscheduler.allowtrue

com.apple.icloud.findmydeviced.accesstrue

com.apple.keystore.access-keychain-keystrue

com.apple.keystore.sik.accesstrue

com.apple.managedconfiguration.teslad-accesstrue

com.apple.mobileactivationd.bridgetrue

com.apple.mobileactivationd.device-identifierstrue

com.apple.mobileactivationd.edatrue

com.apple.mobileactivationd.spitrue

com.apple.narrative.client.sep.accesstrue

com.apple.private.AuthorizationServices

com.apple.trust-settings.user com.apple.trust-settings.admin system.install.apple-software system.install.apple-software.standard-user

com.apple.private.MobileContainerManager.otherIdLookuptrue

com.apple.private.MobileGestalt.AllowedProtectedKeys

UniqueChipID SerialNumber ChipID HasSEP

com.apple.private.RecoveryOS.SystemLockoutControllertrue

com.apple.private.RecoveryOS.SystemLockoutController.DirectRemovaltrue

com.apple.private.RemoteServiceDiscovery.device-admintrue

com.apple.private.accounts.allaccountstrue

com.apple.private.admin.writeconfigtrue

com.apple.private.amfi.version-restriction <integer>1</integer>

com.apple.private.applecredentialmanager.allowtrue

com.apple.private.appstored

DaemonManaged ManagedApp upp Update

com.apple.private.aps-client-cert-accesstrue

com.apple.private.aps-connection-initiate com.apple.mgmt.

com.apple.private.bmk.allowtrue

com.apple.private.configurationprofiles.bootstraptoken.readwritetrue

com.apple.private.configurationprofiles.readwritetrue

com.apple.private.coreservices.canmanagebackgroundtaskstrue

com.apple.private.dark-wake-pushtrue

com.apple.private.efilogin-helpertrue

com.apple.private.endpoint-security.submit.profiletrue

com.apple.private.findmymacd.spitrue

com.apple.private.followuptrue

com.apple.private.iaaccountstrue

com.apple.private.icloud.findmydevice.obliteratetrue

com.apple.private.ids.registration

com.apple.ess com.apple.madrid

com.apple.private.iokit.interactive-pushtrue

com.apple.private.logging.admintrue

com.apple.private.logging.preferencestrue

com.apple.private.managedclient.mdmclient-privatetrue

com.apple.private.managedclient.profiledomainservice.hosttrue

com.apple.private.mis.online_auth_agenttrue

com.apple.private.mis.trust.settrue

com.apple.private.networkextension.configuration-may-skip-prompttrue

com.apple.private.notificationcenter-system

com.apple.mdmclient com.apple.mdmclient.cloudconfig

com.apple.private.opendirectoryd.BootstrapTokentrue

com.apple.private.opendirectoryd.securetokentrue

com.apple.private.push-to-waketrue

com.apple.private.security.allow-migrationtrue

com.apple.private.security.app-installtrue

com.apple.private.security.bootpolicytrue

com.apple.private.security.storage.ConfigurationProfilesPrivatetrue

com.apple.private.security.syspolicy.mdm-kext-policy-managementtrue

com.apple.private.softwareupdated.OSUpdatetrue

com.apple.private.system-keychaintrue

com.apple.private.tcc.allow

kTCCServiceAddressBook kTCCServiceCalendar kTCCServiceReminders kTCCServiceAppleEvents kTCCServicePostEvent kTCCServiceSystemPolicySysAdminFiles kTCCServicePhotos kTCCServiceSystemPolicyAllFiles

com.apple.private.tcc.manager.access.modify

kTCCServicePostEvent kTCCServiceScreenCapture

com.apple.private.usernotifications.bundle-identifiers

com.apple.mdmclient.usernotifications.v2

com.apple.rootless.storage.ConfigurationProfilesPrivatetrue

com.apple.rootless.volume.iSCPreboottrue

com.apple.security.attestation.accesstrue

com.apple.usermanagerd.persona.backgroundtrue

com.apple.usermanagerd.persona.deletetrue

com.apple.usermanagerd.persona.fetchtrue

com.apple.usermanagerd.persona.setbundletrue

com.apple.wifi.associatetrue

com.apple.wifi.scantrue

com.apple.wifi.set_powertrue

keychain-access-groups

ConfigurationProfiles apple appleaccount com.apple.identities com.apple.certificates com.apple.mdm.attestation com.apple.narrative.client lockdown-identities

Interesting Strings

Bundle IDs(475)

com.apple.private.dark-wake-push com.apple.private.findmymacd.spi !com.apple.private.efilogin-helper !com.apple.private.system-keychain "com.apple.mobileactivationd.bridge

File Paths(254)

%@.decode.plist %@.plist %@_Results.plist .installinfo.plist .out.plist

telemetry(19)

/AppleInternal/Library/BuildRoots/4~B_xOugCROZ_M_PPFCT_kXWJPH90G0g535F0r0vY/Library/Caches/com.apple.xbs/Sources/MCXTools/ConfigProfiles/CPCommon/CPAnalytics.mm /System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics 2com.apple.private.endpoint-security.submit.profile <key>com.apple.private.endpoint-security.submit.profile</key>AppStore::submitManifestRequest

URLs & Endpoints(10)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>com.apple.commerce

Network Surface

Networking Frameworks

AVFoundation AppStoreFoundation CoreFoundation Foundation SecurityFoundation libswiftCoreFoundation.dylib

Endpoints(23)

Urlhttps://%@:%u%@

Ipv600:00:00:00:00:00

Urlhttps://mdm.home:14000/dir

HostnamePayloadContent.Name

HostnameMigrationState.20.Started

HostnameMigrationState.40.Finished

Hostnameapple.com

Urlhttps://example.com

Hostnameexample.com

Urlhttps://notthere.apple.com/manifest/001.pkg

Hostnamenotthere.apple.com

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Hostnamesystem.install.apple-software

Hostnamesystem.install.apple-software.standard-user

Hostnamesystem.install.apple-software.standard-user0

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

Methods

-[MDMConnectionHelper sendSynchronousRequestWithBody:error:]-[URLConnectionHelper sendSynchronousRequest:forOpDesc:returningError:]-[URLConnectionLoader sendSynchronousRequest:forOpDesc:returningError:]

DNA Capability Vector

Location

0

Keychain

4

Network

1

Storage

1

Hardware

3

IPC

0

Analytics

1

Security

4

System

2

Behavioral Profile

URL Endpoints

10

Telemetry Strings

19

File Paths

254

Bundle IDs

475

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codef74d39f201e616387e93719e84b28b437b6ba9d1ba55d395073024c4afd4361e

Importsa70783a46ccfe05b1a5a5cb9c0ef2855439e8173a6415cd505ed08ac8d71ab29

Frameworksf9ef18ecd06f1a7db5504f5249ae75d0c351ce2663138c3226a915da41fc83df

Classesbb5b1ddc943aee9f000502dbe5fb5edbfec7026f720ca9721eade0754fce102f

Entitlementsd7971596a7acb4bb9d7e4a13c22953c4d0c4538ca4b6885679f93573a579d85d

Symbolsc48095659a3456bee5b35d54538b1465b7ca15d4d1fd6aff60bdae66e3769539

Static Libraries0 / 3451 functions identified

Functions(3451)

0x100002e00sub_100002e00

0x100003250sub_100003250

0x100003254sub_100003254

0x1000035d8sub_1000035d8

0x100003688sub_100003688

0x100003730sub_100003730

0x10000398csub_10000398c

0x100005540sub_100005540

0x1000055b0sub_1000055b0

0x1000055f4sub_1000055f4

0x100005640sub_100005640

0x10000567csub_10000567c

0x1000057dcsub_1000057dc

0x100005864sub_100005864

0x100005870sub_100005870

0x100005878sub_100005878

0x10000597csub_10000597c

0x1000059ccsub_1000059cc

0x100005a0csub_100005a0c

0x100005a74sub_100005a74

Imports1052 symbols from 64 dylibs

Security191 libSystem.B.dylib159 CoreFoundation123 ConfigurationProfiles121 Foundation74

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

networkserviceproxy

mobileactivationd