Recovery Lock prevents users from booting a Mac into the recovery partition without a password, closing off a common route to bypassing your management controls. Addigy stores the password you set, so you can look it up later from the Devices page if you need it.
Overview
You set a Recovery Lock password per device from its GoLive page. Once set, anyone attempting to boot that Mac into recovery mode is prompted for the password.
- What it does: Requires a password before macOS Recovery will load on a managed Mac.
- Who it's for: Administrators hardening devices against local tampering, and anyone meeting a compliance requirement that recovery mode be protected.
- Key benefit: The password is retained as a Device Code in Addigy, so a forgotten password does not mean a permanently inaccessible recovery partition.
Prerequisites
- The device has an Apple silicon (M series) chip.
- The device is running macOS Big Sur 11.5 or later.
- To view stored codes, your Addigy user needs the Edit Policies and View Devices permissions. Both are included in the default Owner and Admin roles.
If a device does not meet the first two requirements, the Verify Password and Set Password options will not appear on its GoLive page.
How to Set a Recovery Lock Password
- Open the device's GoLive page.
- Select the Security tab.
-
Locate the Recovery Lock section.
- Click Set Password.
- Enter the password, then confirm it.
Note: Setting a password sends an MDM command, so the device must be online for the change to apply.
How to View a Device's Recovery Lock Password
Recovery Lock passwords are stored in Addigy as Device Codes. Use this when a password has been lost, or when you need it to authenticate at the Recovery Lock prompt on a device you cannot otherwise reach.
- Navigate to the Devices page.
- Select Tools > Device Codes.
- Enter the device's serial number in the search bar and click Add.
- Any available codes for that serial number appear, including Recovery Lock.
Codes are also available from a device's GoLive page under the Security tab. To retrieve codes for several devices at once, multi-select up to 15 devices on the Devices page before choosing Tools > Device Codes.
For full details, including exporting codes to CSV, see Device Codes in Addigy.
How to Verify a Recovery Lock Password
Use this to confirm a password works before you rely on it.
- Open the device's GoLive page and select the Security tab.
- In the Recovery Lock section, click Verify Password.
- Enter the password.
Addigy returns a success or failure response.