6

I am trying to restrict the ability for my child to access recovery mode on mac to keep filtering software in place. On intel macs you can set a firmware passcode that is separate from the admin user account passcode (which I do want child to have access to).

Apple seems to have started to address this missing feature with M1 Macs here: https://developer.apple.com/documentation/devicemanagement/set_recovery_lock_command

My question is, can someone help me figure out how to actually implement this on an individual machine without an MDM server?

Or alternatively - I'm mainly wanting to restrict the ability to boot into safe mode specifically. So if anyone has any ideas on how to do that - that would be helpful as well.

Improve this question

3 Answers 3

Reset to default
2

You are right, setRecoveryLock is the replacement on Apple Silicon (M1) Macs for setting a firmware password lock. Apple calls it recoveryOS password.

However, unfortunately, it looks like there is no other way to set a recoverOS password than from an MDM (Mobile Device Management) solution. MDM is offered as a service by several companies. So it looks like we must subscribe to such a solution in order to set a recoveryOS password on our Macs.

After searching the web for a while, I eventually found ManageEngine. This offering has a Free Edition that includes the possibility to set a recovery lock. So this looks like a solution.

I want to note that I'm not affiliated with that company and that I haven't tried their solution myself yet.

I've also had the idea to subscribe to an MDM for one month (or use the free trial), then set the recoveryOS password and unsubscribe. However, I'm unsure about what happens with the managed device after the MDM service has been unsubscribed, but I would assume that the recovery lock remains effective on the Mac.

For the second part of your question (restrict booting into safe mode), see also Any way to block Safe Mode on a Macbook w/ an M1 chip?

Improve this answer
1

You can’t prevent the M1 from being erased, so set a policy in place so the person knows what’s expected and set penalties for if you catch them removing or changing software.

Even with MDM, there’s not a technical way to prevent erasure of the hardware.

I would sign up for JAMF Now which is free for your first few devices and explore if management and a recovery password is good enough for your specific needs.

Improve this answer
0

Make your child a non-admin user, and make yourself an admin user. To access recovery mode, you need to enter the password of an admin user on m1 macs. Only problem where this might cause issues is he needs the admin password, but if he doesnt, then this will work.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .