Category filter
Verify firmware password set on Mac
What is a firmware password?
Setting a firmware password is a security measure on Intel-based Macs that prevents unauthorized users from changing the startup process. When it is enabled, the Mac requires the password before booting from any disk other than the designated startup disk or when using startup key combinations like Recovery Mode or Target Disk Mode. This ensures that only those users who has the firmware password can bypass or troubleshoot the startup process.
Hexnode UEM allows you to remotely set, clear, and verify the firmware password on managed Macs.
Escrowing firmware password in Hexnode
When a firmware password is set via Hexnode using the Set Firmware/Recovery Lock Password action, the password is securely escrowed in the console. To view it:
- Go to Manage > Devices and select the target device.
- Navigate to Security Info under Device Info sub-tab.
- The firmware password will be listed next to Firmware Password.
If the password was changed manually on the Mac, the escrowed value in Hexnode will not update automatically. In such cases, running Verify Firmware Password remote action helps identify whether the current device firmware password matches the one set by the IT admin from the Hexnode UEM console.
Why verify the firmware password?
The Verify Firmware Password remote action is useful in:
- Ensuring the firmware password escrowed in the Hexnode portal is still valid. Or,
- Checking if the firmware password was changed manually on the device.
To execute this action, the admin must enter the firmware password once set on the device. Hexnode then checks it against the Mac’s current firmware password and reports whether they match.
How to verify the firmware password from Hexnode?
- Log in to the Hexnode UEM portal.
- Go to Manage > Devices and select the target device.
- Navigate to Actions > Security > Verify Firmware Password.
- Enter the password you want to check and click Verify.
- View the action status under Action History.
Possible results
After executing the Verify Firmware Password action, the result can be viewed under Action History. If the action succeeds, click the info icon next to the Success status to see the outcome. The message will display one of the following:
- “The password you entered matches the firmware password set on the device.”
- “The password you entered does not match the firmware password set on the device.”
- “No firmware password is set.” (This appears if no password is currently configured or if it was cleared using the Clear Firmware/Recovery Lock Password action.)
Device support
The Verify Firmware Password action is available only on Intel-based Macs running macOS 10.13 or later.
