Without this password you could not boot from anything other than the default boot volume. If you enter the correct firmware password this would then load the desired boot picker or boot option given the key combination. When set, if you hold down the Option key or some other key combination to get the boot picker or other OS, you would be presented with a lock icon and a password prompt. This can also be set via the Firmware Password utility within the recovery OS.
So long as your users are not admins, Apple’s claim of FileVault being an equivalent level of security is valid… but only in this context.įor those who may have not used a Firmware password previously, this can be set (and removed) via the firmwarepasswd command line tool with administrative privileges. Given M1 Macs do not have a firmware password option, any user with valid admin credentials can load macOS installers, other bootable macOS volumes, as well as fully erase and reinstall macOS. In Big Sur, external booting of validly signed macOS installers and macOS boot volumes is now permitted by default. On Intel Macs, the only security mechanism that prevents an admin user from booting to a different OS or the recovery OS is a configured firmware password. While Apple indicates in their support article that FileVault achieves the equivalent level of security, the question is even with FileVault enabled does this open up the ability for users to do mischief? 
This ensured more tech-savvy users could not load their own bootable macOS from the organization’s hardware or boot to the recovery OS and potentially wipe the device entirely. Having previously worked at a school, setting a firmware password was a critical security feature as it prevented anyone without this password from booting to anything other than the configured default boot volume.
0 kommentar(er)
