13

I like to be able to use Touch ID for quickly unlocking my Macbook, e.g. for when I've walked away from the machine for a few minutes but it's still in a safe place.

But I'd also like to be able to lock it properly, with a password, for when I'm taking it out of the office or otherwise want to enforce more security.

By default you need to enter your password after a system restart, or if you get 5 failed fingerprints in a row, or after no login for 48 hours.

Is there a command-line command, or a programmatic way to replicate this state, so I could script it using one of the various automation tools out there?

Improve this question
0

1 Answer 1

Reset to default
9

You're looking for the command line tool bioutil. Probably with the -u option.

Usage:
bioutil {-r | -w [-f { 0 | 1 }] [-u { 0 | 1 }] [-a { 0 | 1 }]} | [-c] | [-p] | [-d <uid>] [-s] 

Options:
    -r, --read                      Read current Touch ID settings
    -w, --write                     Write new Touch ID settings
    -s, --system                    Flag to read/write systemwide Touch ID settings or perform systemwide operations
    -f, --function                  Enable (1) or disable (0) Touch ID functionality in general (system settings only)
    -u, --unlock $value             Enable (1) or disable (0) Touch ID for unlock
    -a, --applepay $value           Enable (1) or disable (0) Touch ID for ApplePay (user settings only)
    -c, --count                     Print number of enrolled fingerprints of the current user or of all users (-s, administrator only)
    -p, --purge                     Delete all enrolled fingerprints of the current user or of all users (-s, administrator only)
    -d, --delete $uid               Delete all enrolled fingerprints of the given user (administrator only)
Improve this answer
4
  • 3
    Hmm - this works, but with a couple of issues: If I run bioutil -w -u 0 and then bioutil -w -u 1 it does what I want - it forces password entry once and then accepts fingerprints again. However, it also always prompts for the user password. Even if run as root/sudo. So hard to script. If I run bioutil -w -s -u 0 as root or admin, it works without a user password - but disabling unlock globally also forgets all enrolled fingerprints, so again not very useful. Thanks, though, this is the closest I've seen to what I want.
    – Korny
    Commented May 8, 2017 at 13:38
  • Is there a way to prefill the password programmatically when the command asks it during execution of "bioutil -w -u 0"?
    – Victor Bocharsky
    Commented Feb 28, 2019 at 17:55
  • You can try using 'expect' to send passwords but obviously this is frowned upon because you'll be hardcoding the pword
    – Hefewe1zen
    Commented Mar 2, 2019 at 1:09
  • 1
    As of 12.2, it looks like there are more options in bioutil now, so you can sudo and then specify the user
    – chronospoon
    Commented Feb 7, 2022 at 19:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .