How to prevent someone from easily erasing an Apple Silicon Mac

[Tony2012]

It used to be on Intel Macs that you could stop someone from starting up in Recovery mode by setting a firmware password.

On Apple Silicon Macs, the firmware password option is not there. So, anyone could go into Recovery mode and just erase Apple Silcon Macs if they wanted to.

Does anyone know of a way to stop that from happening? It seems short-sighted on Apple’s part to easily allow someone to erase a AS Mac and not provide any roadblocks to keep that from easily happening if someone wanted to be malicious and cause you to lose your data.

 

[xraydoc]

It used to be on Intel Macs that you could stop someone from starting up in Recovery mode by setting a firmware password.

On Apple Silicon Macs, the firmware password option is not there. So, anyone could go into Recovery mode and just erase Apple Silcon Macs if they wanted to.

Does anyone know of a way to stop that from happening? It seems short-sighted on Apple’s part to easily allow someone to erase a AS Mac and not provide any roadblocks to keep that from easily happening if someone wanted to be malicious and cause you to lose your data.

Does it not ask for the password of the macOS volume before erasing (presuming File Vault is turned on)?

 

[Tony2012]

No. You can boot into Recovery mode and go to Recovery Assistant and "Erase Mac..." and it will allow you to erase the Mac. FileVault is turned on.

 

[ian87w]

I think Apple did that because of activation lock. So someone can erase the Mac,, but just like the iPhone, the Mac will be activation locked. So basically the same as iPhone. Anyone can restore an iPhone to factory, but there’s activation lock.

I can understand your point though. It would be great if there’s an extra layer of security to prevent such erasures in the first place.

 

[mikes79]

Apple removed the firmware password option for non enterprise managed based Macs, prob to lower tech support calls; that said you can enable similar functionality if the Macs or iOS devices are enrolled in a DEP based enterprise management tool; it is called a RecoveryOS password now, however it requires the use of a MDM tool, like JAMF pro or similar.