2

/tldr - Moved original Apple SSD to new logic board. No firmware password before, now suddenly there is - even on original board (after clean install). Sharing experience and insight from others - not looking to bypass firmware password!!

I run a small repair shop. Customer brought in a 2013 MBP for a board swap. Customer supplied replacement board. Also, original machine and board were from a business (former employer). Repeat customer, no question about legitimacy of original machine - I know 100% laptop was received legitimately from company.

First - she bought a new board because machine was acting up. Turns out battery was exploding (all cells puffed up) but she wanted to replace board anyway since she "wanted to get rid of work stuff anyway". In case she was going to leave old board with me afterwards, I decided to test things out before doing the board replacement.

User was under a managed, mobile account, no admin rights. OK, no problem. I booted into Recovery mode, unlocked drive and mounted via Disk Utilities (users password worked to unlock drive), then ran -resetpassword from Terminal and reset the password for one of the admin accounts already on the machine. No issues after reboot. Logged in with the admin account I just changed password on, created new Test admin account. Everything was great.

So now I have a drive with a full admin account I control. I can work on the managed user account once I switch to new board. To repeat - I already got into Recovery mode on the original board/machine with NO PASSWORD.

Now I install the replacement board, fire it up with the original drive. I get in no problem. New Test account I created works. So does the old managed user account. Ran some tests and used it for awhile, including online activity to make sure replacement board checks out.

Realizing there were a bunch of enterprise policies in place I did want to deal with (for instance new local admin Test account not registered with sudo privileges) I decided a complete reinstall was in order. Customer confirmed no need to save anything.

Reboot into recovery mode - BAM! Password required. OK - maybe replacement board had a lock on it unbeknownst to customer. OK, well at least I can get an OS on the original drive, then deal with firmware password by contacting sell of replacement board. I take the drive out, put it in my shop MBP an install Mojave on it. Take that drive out, pop it in customer machine (remember, it now has replacement board in it) - folder with blinking ?. Can't find boot volume. Hmmm. I know there is a firmware lock, so can't set boot volume.

OK - well, I can always put original board back in and either set boot volume or Internet Recovery since original board had not firmware lock.

Guess what? I put original board back in, original drive (but with clean OS on it) - BAM!! Firmware lock. Again - original board, original drive, just new OS installation. Still blinking ? folder at boot.

Here is my actual question: Is there a way to write a policy/script where there is no firmware lock UNLESS there is a hardware change?

I now have two logic boards with firmware locks. Original board didn't have one on it, now it suddenly does. Don't know where they came from. Something triggered a password.

Additional info:

When I took the original drive and put it in my shop MBP, I went into terminal and ran sudo firmwarepasswd -check. This showed there was a firmware password in place. However, I know my MBP never had a f/w password. So Terminal says there is one, but I know for a fact mine does not. OK - maybe there is a policy that will write one once I shut down?

I shut my machine down via Shift-Option-Command+ Power so it wouldn't write. Checked my MBP once more - still no f/w pw. Rebooted normally went to terminal used sudo firmwarepasswd -setpasswd set a temp f/w password. Rebooted my shop MBP into recovery mode, tested my new password - works. Booted normally, Terminal, removed password, rebooted recovery - no password. Normal boot, Terminal sudo firmwarepasswd -check and it shows no password. Check - everything works as it should.

2
  • 1
    Looks like you copy-pasted two versions of your Q - can you review and clean it up?
    – pion
    Commented Mar 11, 2021 at 20:43
  • TY - original post was all flagged as spam. Double pasted. Commented Mar 11, 2021 at 20:57

0

You must log in to answer this question.

Browse other questions tagged .