I'm trying to temporarily disable KEX signing enforcement on my MBP since my company's VPN client (GlobalProtect) is failing the signature check now. This started yesterday when I did the OS upgrade to Sierra yesterday.

The solution should be running this command:

sudo nvram boot-args=kext-dev-mode=1

The problem is that I am getting the following response, and I can't figure out what it means or what to do about it (meaning I can't connect to my company network, too).

nvram: Error setting variable - 'boot-args': (iokit/common) general error

Does anybody have any ideas of things I could try or otherwise look at to track down the problem?


  • 1
    According to support.apple.com/en-gb/HT206871 it looks like you need to be booted to Recovery to change that – Tetsujin Oct 6 '16 at 12:43
  • That was indeed what was necessary. If you would care to post an answer, I'd be happy to accept it. Sadly, the setting did not fix my VPN problem, but that's another thing entirely.... – Michael Oryl Oct 6 '16 at 13:55
  • ah, OK - will do. I wasn't certain but it seemed relevant. – Tetsujin Oct 6 '16 at 13:57

According to Apple KB : Prepare your institution for iOS 10 and macOS Sierra

...you must use the nvram command to properly set boot-args NVRAM variable. Starting with macOS Sierra, you must be booted to the recovery partition to run this command.

| improve this answer | |
  • This did not work with my Sierra. However, the csrutil option below did! – eduncan911 Mar 20 '18 at 9:28

The kext signing restriction was integrated into System Integrity Protection starting in El Capitan, and as a result the old disable flag no longer works. But there's a new way to do it: boot in recovery mode, and run the command csrutil enable --without kext. I haven't tested it, but my understanding is that this will turn off the kext requirements, while leaving the rest of SIP enabled. If that doesn't do it, try csrutil disable to turn SIP off entirely.

| improve this answer | |

I got the similar issue and resolved the with the help above solution.Thanks..

  1. Get into Recovery Mode by restarting and holding down +R until Apple logo appears.
  2. In the top menu click Utilities > Terminal.
  3. In the Terminal window type:

    csrutil enable --without kext

    and press Enter.

  4. Then restart the Mac.
| improve this answer | |

You need to apply that when in recovery mode. Enter in Recovery mode and then apply the following in the terminal:

nvram boot-args="serverperfmode=1 ncl=262144"

Then, reboot. After rebooting, check the parameter on the terminal via nvram -p

| improve this answer | |
  • Both of these boot-args are related to network performance and have nothing to do with kext signing. – rgov Mar 31 '18 at 6:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .