Find My Mac and Activation Lock

Find My is Catalina’s extension to the existing Find My [Mac/iPhone/iPad] service which has progressively developed since its introduction in the summer of 2010. Although Apple pushes it as a feature of Catalina and iOS 13, many of its features work in Mojave and earlier. The notable exception to that is its integration with security features in the T2 chip, which now provide Catalina’s Activation Lock.

To use Find My features on any Mac, the following need to be true:

  • The Mac and other Macs/devices need to be signed in to the same iCloud account.
  • Location Services need to be turned on.
  • Find My Mac must be turned on.
  • The Mac needs an Internet connection.

Location Services are a fundamental requirement, as they enable that Mac or device to determine where it is, using any available hardware and its Internet connection. Turn them on in the Privacy tab of the Security & Privacy pane. There is a penalty here for those concerned with ensuring absolute privacy: you’ll need to click the button to read Apple’s detailed information about what data Apple receives about your location. There doesn’t appear to be any way to enable Location Services without providing Apple that information.

findmy01

Turning the Find My Mac service on varies according to which version of macOS it’s running. In Mojave, for example, it’s in the iCloud pane, but in Catalina it’s in the new Apple ID pane, listed from the iCloud item at the left. There you’ll also find options to control Find My Mac and Offline Finding; when you enable Find My Mac, both are normally enabled by default.

findmy02

If you’re running Catalina, or an iPhone/iPad with iOS/iPadOS 13, then you can open the Find My app and it will show you the location of all your currently active Macs and devices which have Find My enabled.

findmy03

findmy04

If your Mac or device is lost or stolen, you can then use the Find My app to locate it, play a sound on it (ideal if it’s just misplaced), lock it using a passcode, or erase ‘contents and settings’. These can only take effect when the Mac or device is next connected to the Internet. If you lock your Mac in order to prevent anyone else from using it – a useful measure if you have left it somewhere and hope to recover it – then you can unlock it using the passcode which you set, or through your account on iCloud.com. When you set a passcode, include a message to be displayed telling the person finding that Mac or device how to contact you. Be careful not to give a potential criminal personal information which they could abuse.

When Apple uses the phrase ‘Erase Mac’, or ‘erase contents and settings’, this doesn’t apparently mean completely wipe the contents of that Mac’s internal storage. Although Apple’s documentation doesn’t make this clear, it apparently only refers to some particularly sensitive data on that Mac, such as card details stored in Apple Pay. However, users who have performed this report that they’ve been unable to detect any such erasure. Use this ‘erase’ feature of Find My with great caution until Apple makes it more clear what it actually does.

If you have enabled Find My on a Mac which has a T2 chip and is running Catalina, then your Mac also has Apple’s new Activation Lock, which provides more powerful protection still. You can check whether Activation Lock is enabled on your Mac by opening System Information, and selecting the Hardware item at the left. The last line in that overview should state whether it’s enabled.

findmy05

Activation Lock has two additional requirements which you should already meet:

  • Your Apple ID (iCloud account) must have two-factor authentication enabled.
  • The Mac must have full Secure Boot enabled – that’s the default Full Security setting in the Startup Security Utility (accessed in Recovery mode). This also prevents it from being booted from an external drive.

When Find My Mac and Activation Lock are both enabled, anyone wanting to turn off its Find My service, erase sensitive data, or try to reactivate or use that Mac must enter the password for your Apple ID, or any passcode which you set when you lock that Mac. This makes it even harder for a thief to do anything with your Mac, and provides further protection for the data stored on it.

The snag with both Find My Mac and Activation Lock is that they can get in the way of anyone trying to service or repair that Mac, or another legitimate user – perhaps someone who you give or sell that Mac to.

If you have enabled Find My Mac alone, or in conjunction with Activation Lock, you must remember to turn both off, by turning Find My Mac off on that Mac, before signing out of iCloud. Apple now recommends that you do those before sending your Mac in for service, a topic which I’ll consider in the next article.

Apple’s general information about Find My is here, instructions about what to do when your Mac is lost or stolen are here, and specific information about Activation Lock is here.