Clear Firmware/Recovery lock password on macOS devices

Firmware passwords add an additional layer of security on macOS devices, preventing them from being started from external drives or booted into Recovery Mode without proper authentication. On Apple Silicon Macs, this protection is provided by the recovery lock password.

Why clear firmware/recovery lock password?

While a firmware/recovery lock password is crucial for security, they can sometimes stand in the way of tasks that require administrative access. This includes scenarios like:

• Reassigning devices to new users
• Performing hardware repairs
• Resetting a locked device
• Preparing a device for resale, return or decommissioning

Clearing the lock remotely ensures these actions can be completed without any unnecessary delays.

Clear Firmware/ Recovery Password Remote Action

The Clear Firmware Password and Clear Recovery Lock Password remote actions in Hexnode UEM allow IT administrators to safely remove the firmware and recovery lock passwords respectively from managed macOS devices remotely.

How to clear firmware/recovery password?

Follow the steps below to clear firmware/recovery lock password on Macs,

1. Log in to the Hexnode portal.
2. Navigate to Manage > Devices and select the required macOS device.
3. Go to Actions > Security and click on Clear Firmware/Recovery Password action. This will open up a window where you will be prompted to enter the current firmware/recovery lock password of the device.
4. Then, click Confirm.

What happens on the device end?

Once the action is executed, the firmware or recovery lock password is cleared from the system, allowing the device to boot or enter the recovery mode without requiring password authentication.

FAQ-Frequently Asked Questions

1. Can recovery lock be enabled manually on Macs from the device-end?

   No, recovery lock cannot be enabled manually on Macs from the device itself. Recovery Lock is a feature exclusively designed for MDM-enrolled macOS devices—particularly on Apple silicon Macs. Hence, they can be enabled, or disabled, through the MDM only.

2. Is there a difference between firmware password and recovery lock password?

   Yes, they differ based on the type of Mac hardware. Though they serve a similar purpose of preventing unauthorized access to the device, firmware password strictly applies for Macs with Intel processors whereas recovery lock password provides the equivalent level of security on Macs with Apple silicon.

   Also, a firmware password can be manually enabled and disabled from the device-end whereas recovery lock can only be enabled and disabled from the MDM solution in which the device is enrolled.

3. How to disable firmware password manually from the device-end?

   While starting your Mac, immediately press and hold the Command (⌘) + R keys until the Apple logo appears. Before going into Recovery Mode, you will have to enter your firmware password.

   1. On entering Recovery, go to Utilities > Startup Security Utility from the menu bar at the top of the screen.
   2. Click Turn Off Firmware Password, then enter the firmware password again.
   3. Close the utility, then restart the device for the changes to take effect.