Mac – way to enable “Find the Mac” to locate your computer but not remotely wipe the drive

find-my-macicloud

Find My Mac is a useful feature of iCloud to locate your computer. As recent events have shown, however, if bad guys gain control of one's iCloud account, they can wreak havoc, including remotely erasing the contents of your Mac.

Is there a way to enable "Find My Mac" to find one's computer but not to enable the remote wipe feature?

A good answer would point to some official Apple document about whether or not this is supported. A great answer would say no, this isn't supported, but you can modify this particular file on your computer to prevent remote wipe from happening.

Best Answer

In this Knowledge Base article, Apple write "With Find My iPhone set up on your iPhone, iPad, or iPod touch or Mac, you can locate, display a message, play a sound, remotely lock, or remotely wipe (erase) your device using the Find My iPhone app from another device (such as a friend's iPhone or iPad)."

This is the closest I have found to a direct statement that it's one package: if it's set up, you can locate, display a message, play a sound, lock, or erase. None of the documentation about configuration mentions options to enable these selectively; the control is off/on.

As far as disabling remote wipe, there seems to be a strong indication that the remote wipe involves rebooting to the Restore partition. Evidences for this include the fact that "Find my Mac" will not turn on (be greyed out) if there is no Restore partition present. Also, it would be very difficult for a running process to wipe its own boot drive. The Find my Mac remote wipe causes a reboot. It seems most likely that wherever the remote wipe lives, it's somewhere on the recovery partition.

So, Find my Mac won't turn on unless there is a recovery partition. Remote wipe most likely won't work if the Recovery partition isn't bootable. To enable Find My Mac but disable Remote Wipe, you need to have a recovery partition, and it needs to not successfully boot. Sabotage the recovery system somewhere so it can't boot and thus can't be used as the plaatform to wipe your main drive. Of course you will want to keep an external bootable recovery drive (USB stick?) available if you do this.