Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

There are a few ways to reset the login password of an OS X user account:

  • Starting up in single user mode, running mount -uw /, launchctl load /System/Library/LaunchDaemons/com.apple.opendirectoryd.plist, and dscl . passwd /Users/username.
  • Starting up in single user mode, removing /var/db/.AppleSetupDone, restarting, creating a new admin account, and changing the password of another account from System Preferences.
  • Starting up from a recovery partition or installation media, opening Terminal, and running resetpassword.

Is there some way to prevent people with physical access to a Mac from using them?

share|improve this question
3  
Don't give other people your mac and let them restart it. –  ughoavgfhw May 7 '11 at 1:27
2  
There are always methods to access your data once you have physical access to computer –  Bil_fr May 7 '11 at 11:08
    
A common saying in IT Security circles is "Physical Access = Complete Access." If one person can get in, so can someone else. –  Matt Jul 27 '13 at 21:16

2 Answers 2

up vote 6 down vote accepted

It can be prevented. Boot up your mac with your Mac OS X install DVD, and after it has loaded, go to utilities and select Firmware Password Utility. Select the checkbox "Require Password to start this computer from another source" and type in a password.

This password will prevent people from:

  1. Booting CD/DVDs
  2. Booting into Single User Mode
  3. Booting into another OS stored on another partition or disk

No. 2 is the one where people type commands in it to reset the setup data in which they can go through the setup procedure and set up a completely new administrator account.

However, the best way is to keep your mac with yourself. Anyone with root/administrator access can bypass this feature, by typing a few commands in the terminal. Keep your password secret and complex.

It is also worth mentioning that the EFI password is easily crackable. Some people had success with resetting the PRAM and gaining access, while others used exploits in the OS X system to gain root access and disabling the password using terminal commands. The way Apple encrypts is also very lax and you should make it very much different from your OS password.

share|improve this answer
    
so there really isnt anyway to lock that as well? –  luca590 May 7 '11 at 4:18
    
it is possible to lock securely, as long as your user account password is kept secret and that you never ever let people who you do not trust use your mac without your permission –  user6124 May 7 '11 at 5:21
    
but my password doesnt matter because you do obviously dont have to have one for them to restart my computer and type in the commands –  luca590 May 7 '11 at 15:08

If you have 10.7 or later, another option is to enable FileVault 2. It makes starting up in single user mode require entering the password of an account that has been allowed to unlock FileVault, like normally your own user account.

Starting up from the recovery partition won't require a password. But the list of volumes in Reset Password.app will be empty:

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.