Supervise iOS devices

Supervising an iOS device mainly allows you to install profiles with more powerful restrictions that you can't enforce even using Screen Time. Entering supervised mode is useless if you don’t have profiles. I added a profile with lots of features here (check them below before starting), but you'll have to edit it according to your needs. The profile will fail to install if don't supervise the phone. Check out its features below.

It also allows you to enable Screen Time features like the built-in web filter using profiles (.mobileconfig files). You could do that, if you don't want anyone to enter a PIN for you and if you don't want to use a recovery Apple ID.

Stage 1: Entering Supervised mode.

Your phone will will have to erased, so take a copy of the data you need.

-Supervise using a mac:

Spoiler

-Apple configurator 2 (macOS only, free)
Entering supervised mode using Apple configurator 2: (watch only till 3:00, the rest of the video does not concern us)
www.youtubecom/watch?v=369P2RGIbso

-Supervise using a Windows PC

Spoiler

-iMazing cracked (windows):
V 2.13.1
https://www.mediafire.com/file/dql4tqa0qabcbpk/iMazing2.13.1.exe/file
Patch:
https://www.mediafire.com/file/3seeiji37wtbr71/Patch2.13.1.zip/file
The zip password is 1234
The patch is detected by windows defender as a Keygen. You'll have to allow it. Do not launch imazing or shut it down from the task bar if already running. Copy the patch exe file to the install directory of imazing (C:\Program Files\DigiDNA\iMazing) then run it.

Entering supervised mode using iMazing:
https://imazing.com/guides/how-to-supervise-iphone-ipad
(leave "Allow pairing without supervision identity" as true or you might be locked out of your phone)
You might get an error on imazing after supervision, just ignore it and open your settings app, you should see the supervsion notification at the top.

(This is an older version of imazing, just saving it here:
V 2.12.7:
https://www.mediafire.com/file/8tsbys7gtpot26l/iMazing+v2.12.7+Final+++Crack.zip/file )

-Outdated supervision methods:
These should still work but every time an iOS update installed, supervision will be removed. Your phone will not be wiped if you use these methods. So useful for trying out supervsion:

Spoiler

Enter Supervised mode using iBackupBot (Windows/Mac)

Spoiler

Your device will not be wiped.
Requirements:
1-The latest version of iTunes:
For windows don't use the Windows store version of itunes. Instead use this:
https://www.apple.com/itunes/

For macOS Catalina or newer: The itunes app is replaces with Music app, so you'll get error -32 when restoring the files if you don't install iTunes using this method:

Spoiler

Step 1 Check your MacOS firmware by going click on the Apple logo on the top left hand side of the screen, then clicking on "About This Mac". If you are running Version: 10.15.7 or later, move to step "2b". Otherwise move to step 3.
Step 2b You need to download and install iTunes using "Retroactive 1.9":
https://www.mediafire.com/file/a0p62f3j9zcnico/Retroactive.1.9.zip/file

Step 2c After downloading, go to your downloads folder, and click on "Retroactive.zip" to extract it.
Step 2d Navigate and open the extracted folder, then right click on "Retroactive", and select open.
Step 2e MacOS will block the app from opening. Click on "cancel", then repeat by right clicking Retroactive>open.
Step 2f This time Retroactive will open successfully. If you get: "Update to a newer version of Retroactive" simply click on "Run Anyways"
Step 2g Click on "install" below iTunes, then click on "continue".
Step 2h Now iTunes will start downloading.
Step 2i Once iTunes is installed, you will see a screen which says: "One More Thing". On this screen, select "I don't need to sync with this iPod".

2-iBackupBot:
http://www.icopybot.com/itunes-backup-manager.htm
Important If you're on macOS:

Spoiler

-After you drag iBackupBot to your applications folder. Go to Applications folder from finder and right click ibackupbot>open. MacOS might block the app from opening. Click on "cancel", then repeat by right clicking ibackupbot>open.

-Now, open System Preferences>Security & Privacy>Privacy tab. Click on the lock to make changes. When prompted enter your passcode to the Mac itself.
-After the lock is unlocked, click "Full Disk Access">"iBackUpBot" and click the check box to tick it. If iBackUpBot doesn't show up, click the "+" near the bottom, navigate to "Applications" and select "iBackUpBot" from there.

-Keep in mind iBackupBot crashes a LOT on Macs. If the app crashes, simply re-open it.

3-A backup from a supervised iPhone
https://github.com/John889/ios_supervised_backup/raw/main/supervised_backup.zip
The password of the encrypted backup is 1111
4-Turn off Find My iPhone on the device you want to supervise.

Video instructions:
Please, follow the instruction carefully and make sure you type config in the search bar as in the video or else you could accidentally restore the whole backup and wipe your applications data. You only need to restore one folder.

You might want to turn on Find My iPhone after you're done.

Enter Supervised mode using Mobicip Supervision tool (Windows/Mac)

Spoiler

Your device will not be wiped. This is almost the same as using the iBackupBot method.

1-Download the latest version of iTunes.
2-Create a Mobicip account: open the following link, enter the required info (Name, email and password), click Sign up THEN close the tab when it asks you for a credit card.
https://www.mobicip.com/signup
3-Download and install Mobicip Supervision:
https://www.mobicip.com/v1/content/how-do-i-supervise-my-child’s-ios-device
On Windows, two apps will be installed: Mobicip and Mobicip Supervision. We only need Mobicip Supervision.
4-Open Mobicip Supervision, login using your Mobicip account then follow the steps to enter Supervised mode (You'll have to disable Find My iPhone).

If supervision failed, you'll probably have to use another PC/Mac. Try backing up your iPhone using iTunes, if it failed this means the issue is with the PC not Mobicip.

Turn on Find my iPhone after supervision is applied.

Stage 2: Editing and installing the profile + profile features

Spoiler

Features: (You could modify anything in the profile)
*Enforces Cleanbrowsing Family DNS which blocks porn, enforces safe search. (iOS 14+)
*Blocks some social media sites, images and videos on reddit and twitter. It works on all browsers including Safari. You could remove sites that you don't want to block
(You could edit the profile and use any DNS you want.)
*Blocks adding VPN connections.
*Blocks wiping your phone
*Blocks many unsafe browsers including Tor browsers and many others. You could add any app you want. Use this site to easily get the BundleID of any app on the App store:https://offcornerdev.com/bundleid.html
*Contains FortiClient payload which means you just need to download forticlient for iOS and activate it using EMS.

Spoiler

FortiClient on iOS works the same way as the built-in "limit adult content" which means it will work on all browsers and will filter everything you enter in the browser's address bar.
FortiClient is highly recommended because it has a huge website database and will block any site that is missed by the built-in blocker.

-For setting up the EMS, check out FortiClient under the Windows section here.
-On your iPhone:
-Install this version of FortiClient:
https://apps.apple.com/us/app/forticlient/id1474294106
-Connect FortiClient (iOS) to FortiClient EMS installed on your windows PC:
youtu.be/4WMnvKCyyEY?t=186

Note: if you get this error, it means either your phone is not supervised or you haven't installed the profile containing the forticlient payload.
https://i.ibb.co/pj32K8H/6-error.png

*The profile is password protected and you have to edit it using any text editor before you install it on your phone to change the default password which is nofap to any other password and save the new password on lockbox.pluckeye.net
*I also highly recommend changing the default payload identifier which is com.sinner.applerestriction to anything random like com.asfdasdf.asdfohbiw
This will make bypassing the profile way harder.

*Optional:
*Disable Find My app.
*Disable installing .mobileconfig profiles
*Disable uninstalling or installing apps.
*Disable connecting your phone to a PC/Mac.
*Disable recovery mode (Dangerous, not needed and not recommended)
*Lock hotspot settings.
*Enforce the built-in iOS porn blocker "limit adult content", and whitelist or blacklist sites.
*Disable Siri/Spotlight internet results.
and much more.

Filtering Profile:
https://github.com/John889/iOS_filtering_profile/archive/refs/heads/main.zip
Extract the zip file and you'll get a folder containing iOS_filtering_profile.mobileconfig. This is the file you want to edit.
Edit it using a text editor and NOT using imazing profile editor because lots of the features that I entered manually will be lost. You'll find all the steps you need in the file.

The profile is not signed which means that you could edit it and add any features you want.


To install the profile, you can only use any of the following methods:
A- Send the profile to your phone device via Airdrop if you're on a mac.
B- Send it in an email to yourself and open it from the Mail app (not other email apps)
C- Upload it, then download it on your phone using Safari.

If you use other apps to download the profile, like the Chrome browser, for example, it won't work.

If you want to create your own profiles, imazing profile editor is a good start:
https://imazing.com/profile-editor

 

reserved

 

reserved

 

I think so. I believe we won't need to block browsers, if we enforce a DNS. The problem is with enforcing DNS on devices running iOS 12,11 and 10.

 

Do you mean "Limit Adult Content"? Who needs that, if we could enforce a DNS?

 

I think we could disable adding VPNs using supervised mode.

 

Not with mobicip. You'll have to install a profile that does that.

 

DoH and TLS support was added on iOS 14. I have tried copying DNSCrypt's VPN profile but it didn't work because Always on VPN could be enabled on IKEV2 VPNs. The only way to do it is by using Algo VPN and hosting the VPN somewhere like Amazon EC2

 

Because it uses safesurfer DNS. I didn't use any other DNS such as cleanbrowsing because I cannot customize them. This one blocks reddit and twitter images and videos. You could create your own account here:
http://www.safesurfer.co.nz/
then download a profile for iOS or macOS. You'll find that the IP address in the profile is 35.227.226.142
I wanted to block more stuff like tiktok, for example but Safe Surfer updated their plans and unless you pay, all your settings would be ignored and only the default categories would be blocked. So I was left with that account.

 

Could you show me a screenshot, please?