Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Not firmware and not encrypted, whats next?

D

dukenuke1221

macrumors newbie
Original poster
Nov 18, 2017
2
0
Hello all, I recently purchased a macbook air 2017 version and after a couple months, when I try to use recovery mode with "command + R" keys during startup, I get a lock screen requesting password. It looks like the same screen as a firmware password request, however, I never set up a firmware password. In addition to this, I can access OS and log in during normal start up. So this seems to rule this is a firmware password. Also, I have checked Security & Privacy > Firevault and confirmed that this is not enabled.

What's next?

Thanks!
 
If you get the simple blank password box, with the padlock, that's a firmware (EFI) password.
It does not appear when you boot to your normal boot drive, only when you try to boot to some different bootable drive or partition, such as your recovery system.
Another tip is to try an NVRAM reset. If you also see the password box when attempting that reset, that's another clue that you have the firmware password set.

Do you allow anyone else to your your MBAir (and that person would have some knowledge of how to set that EFI password!)?

Here's an Apple support article that tells you how to turn that password off --- or how to proceed if you don't know what the password is, and you would like to clear it (and you can prove with a sales receipt that you own your MBAir)
(It also shows you a clear picture of the password box, so you can compare with what YOU see! )
 
Last edited:
  • Like
Reactions: Weaselboy and dukenuke1221
Thank you for your response DeltaMac. Is there any logging that could tell me when the firmware password was set? It is possible someone had access recently. Also, if I go to Apple to get this resolved, is it possible for them to get the cleartext firmware password that was set? This would prove to me that I didn't set the firmware password.
 
My expectation is that Apple can clear the password, but not likely be able to tell you what that password was.
If you have already tried your own likely passwords, and nothing works, then you may not ever find out what that password was. But, turning off the EFI firmware password is really your goal in the first place. You COULD ask Apple if they can retrieve the actual password during the process. I would doubt it, as turning off that protection simply removes the password (and without telling you what that password was --- it's just off/gone.

You COULD ask Apple if they can tell you WHEN the firmware password was first activated. I don't know if they can, or not.

After you get the firmware password turned off, there's another direction that you could go on this, assuming that someone just pulled a prank on you. I'm guessing you know who it might be :rolleyes:. They may try the same trick again. You could prevent that by enabling the firmware password yourself, with a password that only you know. No one else would be able to change that, without knowing the password. (I might do that myself with those same circumstances.)
 
Contact the person you bought it from to find out what the firmware password is.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back