Help from a real expert please - Apple Pay disabled

[donawalt]

Well, I get the message, when I go to System Settings/Apple Pay, "Apple Pay has been disabled because the security settings of this Mac were modified."

I suspect what happened was I wiped this Mac a few days ago and via Migration Assistant restored from backup. But I didn't explicitly change any security settings. I have an M3 Pro MacBook Pro.

There are threads on this issue over the years, but most are pre-Apple Silicon. All Apple's support site says is make sure laptop lid is open, and check for latest software updates. These are fine.

Some have said turning on "Install Security Responses and System files" under General/Software Updates, click the 'i'; under Automatic updates - for me they are all turned on. I tried toggling off and on. Also, anyone I found saying this worked was on an Intel Mac.

I checked the security token is enabled via sysadminctl -secureTokenStatus <account>. There is currently only 1 account on the Mac, my admin account which I checked; the Guest account is disabled.

I went to Recovery mode and ensured that Secure Boot is full security. I tried lowering the setting, then going back in and resetting to full security.

All these are enabled - SIP, Signed System Volume, Kernel CTRR, Boot Arguments filtering. Allow all kernel extensions is set to no.

User Approved Privileged MDM Operations and DEP Approved Privileged MDM Operations are both No.

XProtect, XPR, MRT, TCC, KEXT, iBoot firmware are all up to date.

FileVault is on.

I tried the trick of adding another admin user, logging in to it, logging out and into my account, and then Apple Pay was no longer disabled when I went back to my regular account! But a day later it is again disabled, and I left that second account there. I have since deleted it again.

I have tried with Advanced Data Protection on, and off.

I considered Apple Support, but several people noted they were no help plus they had to wait extended times on the phone - only option. I checked their Twitter acct., it just redirects to the page saying to phone call.

I may have tried other stuff too, but that's the main list.

I know it's a long shot, does anyone have an idea how to fix this? Thank you and fingers crossed!!!

 

[Bigwaff]

I can't say I am an expert in any regard but I do recall reading somewhere that "Security Response and System files" installs could fail or have an install bug which puts the status of SIP in a weird state. System reports SIP is enabled but it isn't. Try Recovery mode again, launch terminal, and explicitly enable SIP .. even if it reports SIP status it is already enabled.

 

[donawalt]

Thank you for the suggestion @Bigwaff ! Unfortunately it did not work, I even tried to be more thorough in how I tested:

1) Booted to recovery mode and disabled SIP; restarted; booted into recovery mode and enabled SIP; restarted.
2) I also booted to recovery mode and enabled reduced security policy, and turned on User Approved Privileged MDM Operations and DEP Approved Privileged MDM Operations; restarted; booted into recovery mode and turned off User Approved Privileged MDM Operations and DEP Approved Privileged MDM Operations; turned on highest security policy; rebooted.

I appreciate the brainstorm. Are there any other ideas why this might be happening? Thank you for your help!!

PS - I can't believe they don't tell you WHAT is wrong, nor can I believe that they are this strict on security policy for credit cards when I can just type them into a browser window...

 

[donawalt]

Oh the other thing I tried in vain - reinstalling MacOS 14.2.1 in Recovery mode.

 

[donawalt]

*****FIXED!!!!!!!!!!!!!*****

😄😄😄😄😄

And I NEVER found this solution anywhere on the internet in almost 5 days of searching, so take note!!

This morning I ran Disk Utility in Recovery mode just to see if it found anything - it did not. But then...

I take back my comments about Apple Support. Out of desperation I called the general Apple Support line - 30 second wait. They quickly moved me to Apple Pay support. All checked out there, they moved me to Mac tech support level 1. Then I moved to level 2, Anita - who was AWESOME. She was in some sort of online chat with engineering at some point, as she saw from my list above that I had already covered almost everything she had on her list.

Everything I mentioned above that I tried, we reviewed. Some things they verified by getting screen access to my Mac. In addition, we tried booting in Safe boot mode to eliminate a bunch of possibilities (Apple Pay still disabled). Anita also had me turn off "Install Security Responses and System files" under Settings/General/Software updates, which did not work (I found that odd to turn it OFF. Anyway....)

So then, Anita/engineering suggested a Reset of my keychain:

- Run the KeychainAccess app;
- Go to Settings and "Reset Default Keychains"

As soon as I exited from that and checked the Settings/Wallet & Apple Pay screen, the message had now changed. Instead of just saying "Apple Pay was disabled because the security settings of this Mac were modified.", it said "Apple Pay was disabled because Install Security Responses and System files was turned off"! Plus, the button that did say "Learn more" that went to a general Support web page, now was a button that said "Turn on Install Security Responses and System files". I clicked it, went back, and Apple Pay was no longer disabled! I added 1 credit card just to be sure all was working, and it was.

So - my Keychain was corrupted!!! Probably if Install Security Responses and System files was turned on, as soon as we Reset the Keychain, Apple Pay would have worked!

Anita was a champ - the whole process took 1 hr 45 minutes. I have been reentering passwords etc., but all is good now!!!!

Thanks for reading all this - I hope it helps someone, some day.

 

[Apple_Robert]

If KeyChain gets corrupt and has to be reset, what happens to the MFA 6 digit codes that are set up in KeyChain? Are those destroyed?

 

[donawalt]

Sorry, not sure what this is or how it might be impacting things. I use a separate iPhone app for 2FA?