This control sets a recovery lock password on Apple Silicon Macs, so nobody can use recoveryOS without it. Use it to block unauthorised access to recoveryOS.
Overview
macOS |
Windows |
Linux |
iOS / iPadOS |
Android |
|---|---|---|---|---|
✅ (Apple Silicon only) |
Intel Macs do not support recovery lock. Factorial IT skips them, and compliance shows no recoveryOS protection status for them.
Before you start:
- The Macs are Apple Silicon and enrolled with the right supervision level. A Mac that is not supervised cannot be fully protected.
- Fleet's Recovery Lock password option is off, in the Fleet console under Controls > OS settings > Passwords.
Factorial IT manages the recovery lock password. Do not switch on Fleet's Recovery Lock password option for the same Macs, because the two clash. While Fleet's option is on, Fleet blocks the Factorial IT command on newly enrolled Macs, and the password Fleet shows may not match the one on the Mac.
How to use
- Go to MDM > Controls > Add new control and choose recoveryOS protection.
- Choose where the control applies: all macOS devices, specific device groups, or a custom target. There is nothing else to set.
How it works
Factorial IT sends the MDM SetRecoveryLock command to every targeted Apple Silicon Mac, with a 12-character password it creates. From then on, the Mac asks for that password before anyone can use recoveryOS. Every device gets its own password. To see it, open the device panel and click Display recoveryOS password.
Factorial IT sends its password without the current one. If a Mac already has a recovery lock password from another tool or another MDM, it rejects the new password and keeps the old one. The device's recoveryOS status then shows Protection failed.
Once the device is protected, use the password from Display recoveryOS password. In the Fleet console, Show Recovery Lock password only shows passwords Fleet set itself, not the one Factorial IT set.
Compliance reports the protection status of every targeted Apple Silicon Mac.
Change or switch off the control
Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement. It does not remove settings already applied on devices.
Tips and Best Practices
- Switch off Fleet's Recovery Lock password option first. Otherwise new Macs end up with Fleet's password instead of the Factorial IT one.
- Check supervision before you deploy. Macs that are not supervised cannot be fully protected.
- Take the password from Display recoveryOS password. The Fleet console does not show the password Factorial IT set.
- Ignore Intel Macs in the compliance view. They are skipped and show no status for this control.
Troubleshooting and FAQ
Troubleshooting
A Mac shows Protection failed.
- The Mac is not supervised. Check its supervision level first: a Mac that is not supervised cannot be fully protected.
- Fleet's Recovery Lock password option is on. Fleet then rejects the Factorial IT command and sets its own password on newly enrolled Macs. Switch the option off in the Fleet console, under Controls > OS settings > Passwords.
- The Mac already has a recovery lock password from another tool or another MDM. It rejects the Factorial IT password while that one is in place. Contact support@factorial.it to remove the existing lock.
FAQ
- Does it work on Intel Macs?
- No. Recovery lock is only available on Apple Silicon. Intel Macs are skipped.
- Does every Mac get the same password?
- No. Each device gets its own 12-character password.
- Where do I find a Mac's recoveryOS password?
- Open the device panel and click Display recoveryOS password.
- If I disable the control, is the recovery lock removed?
- No. Enforcement stops, but settings already applied stay on the device.