"Reduced Security" not required to install and boot USB external

[Mike Boreham]

There are number of threads around about problems installing on and booting from external drives. The general comment is that "Reduced Security" is required in the Startup Security Utility. My own successful test installs have all been done with Reduced Security.

But I have just installed onto and booted a Samsung T5 connected directly to my M1 MBA with Full Security set, using an 11.1 bootable USB.

 

[Apple_Robert]

That is rather strange. That shouldn't have worked. I don't recall reading anyone else being able to do so.

 

[Mike Boreham]

deleted, posted below as reply to #2

 

[Mike Boreham]

That is rather strange. That shouldn't have worked. I don't recall reading anyone else being able to do so.

One of the methods of restoring a Carbon Copy Cloner backup now involves installing onto an external then migration from the CCC backup. When one of my earlier attempts at doing this as a test failed at the install stage, I emailed Mike Bombich, maker of CCC about it, and he replied that it had worked for him (but he was also getting other failed reports like mine). He specifically said that he had not used Reduced Security on his M1 Mac.

I suspect the reason you haven't heard of anyone else being able to do so is that most of us who have been investigating this have been doing it using Reduced Security as one of the first things to try. We now know that Reduced Security did not work, so other things have been done. Having succeeded by doing other things, they have not gone back and tried it with Full Security as I have just done.

I now know that the key factors in my successes was been direct connecting to the MBA (not via a dock) and using a bootable USB installer. I have done A-B-A tests to confirm that the direct connection is essential but I haven't done the same for the bootable USB installer, so a Recovery install might work now.

 

[chabig]

There are number of threads around about problems installing on and booting from external drives. The general comment is that "Reduced Security" is required in the Startup Security Utility. My own successful test installs have all been done with Reduced Security.

But I have just installed onto and booted a Samsung T5 connected directly to my M1 MBA with Full Security set, using an 11.1 bootable USB.

M1 Macs can boot from any selected external drive with full security, which verifies the integrity of the operating system. It does not prevent booting from external drives. The key thing to understand is that the machine won't just boot from any attached external drive. It will only boot from a selected external drive, which means that only someone who knows an admin password can do it.

Use macOS Recovery on a Mac with Apple silicon

Learn how to use macOS Recovery on a Mac with Apple silicon.

support.apple.com

 

[Mike Boreham]

M1 Macs can boot from any selected external drive with full security, which verifies the integrity of the operating system. It does not prevent booting from external drives. The key thing to understand is that the machine won't just boot from any attached external drive. It will only boot from a selected external drive, which means that only someone who knows an admin password can do it.

Change your Mac startup disk

Change the startup disk of your Mac using Startup Disk settings.

support.apple.com

Yes thanks for confirming and the link, which is applicable to M1 and Intel and makes no mention of Reduced Security.

Reduced Security is not needed to boot an external created on my Mac by me. Consistent with this is that Mike Bombich's reply also said that Reduced Security would be required to boot an external created on a different Mac.

 

[Mike Boreham]

This recent article by Howard Oakley about external booting throws more light on this subject. A key quote is:

"In practice, at least as far as Big Sur 11.3.1 is concerned, Full Security means that the system allows only booting macOS which has the same (or a later) version as that installed on the internal disk. Once its internal SSD has been updated to 11.3.1, an M1 Mac won’t boot from 11.3 or earlier on any external disk in Full Security mode (with one notable exception described below)."

So Full Security allows external booting from the same or later macOS version.

Reduced Security is required for booting from an earlier macOS version.

This may explain some of the confusion on the subject.