6

My teen son is highly addicted to porn. After tons of research, I have set up very strong DNS filtering and powerful website and app blockers on his computer. These launch on login and are are unable to be killed because Activity Monitor and other workarounds are blocked. I have admin rights, he is a standard user. However, he's figured out how to start the Mac in Safe Mode, which doesn't launch the website and app blockers on startup and thus are rendered useless. My son has a Macbook Air with an M1 chip.

And yes, we're working on other methods to get him to stop. He has no phone, for example.

As we work through parenting - is there a way to disable or block Safe Mode from being used?

3
  • 5
    Control at the router, not any device. Of course that might limit your access as well...
    – Solar Mike
    Commented Mar 28, 2022 at 6:58
  • Welcome to Ask Different. I don't think you can block Safe Mode, would replacing the MacBook with an iPad be an option?
    – jaume
    Commented Mar 28, 2022 at 12:54
  • Had you tried controlling via screen time?
    – Joy Jin
    Commented Mar 29, 2022 at 1:37

2 Answers 2

3

It seems possible to use the recoveryOS or firmware password protection to restrict safe mode.


On Macs with Apple Silicon, a recoveryOS password can be set using MDM with the SetRecoveryLock command. If a recoveryOS password is set, the user cannot access the recovery environment including startup options screen without entering that password.

See Apple Support: Startup Security in macOS - recoveryOS password for details.

However, I have no personal experience using MDM, but it seems like in order to use MDM, you have to enroll the Mac in the Apple Business Manager. Unfortunately, this seems to require a DUNS number (a business ID). There are third-party MDM alternatives available as well. Refer to question Password protect recovery mode apple silicon with new Recovery Lock Command for possible solutions.


On Intel Macs with a T2 chip, a firmware password can be set in Utilities > Startup Security Utility after booting into recovery mode. See Apple Support: About Startup Security Utility on a Mac with the Apple T2 Security Chip for details.


FileVault work-around

As a work-around, you may use FileVault to limit access. If you disallow the user to unlock FileVault, then the user won't be able to boot the Mac. However, this means that an admin user always has to boot the Mac first, then once it's running, the limited user can login.

To disallow FileVault for the user:

sudo fdesetup remove -user username
2
  • 1
    There is no firmware password on Apple Silicon macs as there is no T2 chip in them.
    – bmike
    Commented Mar 29, 2022 at 3:11
  • @bmike You're right, I overlooked that. Edited my answer.
    – not2savvy
    Commented Mar 29, 2022 at 9:30
2

No - Safe Mode is how the system allows fixing things. Even passcode locks allow erasing.

  • As the commenter mentioned, you will need to have the router put all machines into a subnet where there is no internet. Then you’ll have to set up VPN to get your trusted machines out of “jail” and back on to the internet.
  • There is no firmware password on Apple Silicon so you need to leverage something that safe mode disables to enable your internet for your plan to work.

Practically, it will be much easier to use iCloud Activation Lock and an MDM to send a lock command for when you need to prevent a boot and then unlock it when their suspension period is over.

  • Physical custody / supervised access is likely going to be your only way if you can’t set up logging on the router and then reward / discipline for when they exert self control and when they lapse.

Even MDM lock isn’t foolproof since I believe they can still wipe the machine and set up a new account bypassing your system controls, lack of admin access and more at the expense of all the data and apps on the Mac. This is where a business or school would use Apple Busniess Manager / Apple School Manager and DEP and a consumer can use iCloud Activation lock to prevent reuse once the Mac is erased.

Good luck, there is rarely a technical solution for people problems, when the people problems are big enough and compliance can not be pre-negotiated and checked regularly.

2
  • MDM recoveryOS password can be bypassed in DFU mode, but I guess that goes beyond the protection that was asked for.
    – not2savvy
    Commented Mar 29, 2022 at 9:32
  • Possession or the device is really carte blanche on the new hardware. Data can be encrypted, but access to erase is effectively granted by several mechanisms now @not2savvy
    – bmike
    Commented Mar 29, 2022 at 9:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .