3

I'm looking for a way to prevent Boot Camp from being used on a mac. IDEALLY while keeping the user as an admin (or close to it). The issue I see is that basic user access is too restrictive and admin is too liberal. Users should be trusted to install their own apps yet I don't want them booting from a different partition.

I've tried to delete Boot Camp Assistant but that is restricted, even when using csrutil. I can't even set the permissions on it.

Any ideas on how to disable or remove it while allowing users to install other apps?

I saw How to disable Boot Camp and prevent any other OS installations? but it doesn't have an accepted answer (because it doesn't answer the question)

6
  • Well, (a) don't give them admin, use a managed solution such as JAMF, (b) set a firmware password, then they can't choose an alternative boot. Not that I recommend firmware passwords (that's why I'm not making this an answer), people seem to decide to forget them, not record them, etc. May 26, 2021 at 22:25
  • One possibility is to use a settings profile generated by macOS Server's Profile Manager to block BCA. Obviously you need a copy of Server and possibly another Mac - I've not tried applying restrictions generated by PM onto the Mac running Server but once the profile is created you could remove Server as it's tied to your Apple ID and can be downloaded as necessary). This may give you the granularity over your user's access rights you're looking for and it's worth remembering App Store purchases don't require admin privileges to install - other than macOS installers which always require admin. May 26, 2021 at 23:20
  • 2
    This is easy. Upgrade the users to Apple Silicon Macs. Done. No more Boot Camp. May 27, 2021 at 1:22
  • 1
    @JamesBrickley While true - in the direct sense, dual booting to Linux is still possible which I believe is the point of this question - maybe I'm misunderstanding
    – Ezekiel
    May 27, 2021 at 2:33
  • 1
    @Ezekiel Elin it was tongue in cheek an attempt at humor. Boot Camp has always supported Windows and there is no more Boot Camp in Big Sur on Apple Silicon Macs. They are running ARM instruction set binaries. Windows 10 for ARM available via Insider Preview access will run on Parallels on Apple Silicon. VMware doesn't yet support Apple Silicon. The secure boot default is to not allow untrusted OS to boot. There are people working on dual booting Windows 10 ARM and Linux ARM distributions. May 27, 2021 at 3:01

2 Answers 2

1

Set a Firmware Password - that prevents any startup other than the OS you allow.

This works for Intel Macs which covers your Boot Camp request neatly.

0

One of the simplest methods of preventing the use of Boot Camp Assistant to install Windows on a drive is to create a Fusion Container on the drive and install macOS into this container. Normal, a Fusion Container is composed of a partition on a SSD and another partition on a HDD. Here, I intend for the Fusion Container to have both partitions on a single drive.

The Boot Camp Assistant requires very specific partitioning arrangements to exist before allowing Windows to be installed. The configuration I propose would not meet the requirements. Also, a user would not be able to change the partitioning from macOS to meets the requirements.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .