EFI Password/Firmware Unlock Guidelines - GSX

Last Modified:07 Aug 2017

The Extensible Firmware Interface (EFI) defines the software interface between the Mac operating system and a device's firmware. The EFI Firmware Password is a security function that will not allow you to boot to a device unless you have the password. Customers may request assistance with recovering or resetting their EFI Password.

The customer must be able to provide proof of ownership for their Mac for you to help reset or restore EFI firmware. A valid proof of purchase and identity verification is necessary to request an unlock.

1. Requests for individually-owned Macs

A. Create a Service Non-Repair record with the customer's information by clicking “New Repair” and selecting “Service Non-Repair Case-NTF."  If you do not see the “Create repair" button and must go through the troubleshooting flow, the recommended process is to select Startup and power and Will not start up, then select Yes for the Quick Checks resolving the issue. 

You will then be able to create a new Service Non-Repair record.

B. Scan or legibly photograph the proof of purchase (POP) for the Mac being unlocked.

C. Check the customer’s photo identification (government-issued or school) and verify they are the individual listed on the POP. Include in the "Repair Notes" field of the Service Non-Repair record that ID was provided by a customer and describe the type of ID (driver's license, etc.).

D. Follow these steps to request an EFI unlock:

1. Create a GSX Help escalation with Issue Topic “Technical Troubleshooting”, to upload the scanned POP document.
2. In the notes, include the form of ID used to verify ownership. Do not take a photograph of the customer's ID.
3. Once the request has been created, initiate a AppleCare Channel Support (ACS) Chat with Issue Category “EFI Password Reset”. Include the GSX Help escalation number in your pre-chat survey.
4. ACS will review the GSX Help escalation and provide the unlock file or request additional information. 
5. If you do not wish to chat, ACS will respond to the GSX Help escalation within 1-business day, with the unlock file or a request for additional information.

2. Requests for business, school, and other institutionally-owned Macs

Enterprise and Education customers usually have agreements for Service and Support that are self-servicing, or other means to escalate unlock token requests. DO NOT issue tokens to students or employees directly unless they can provide both a proof of purchase and identification associated with the school or institution. If they do not have a proof of purchase and ID, instruct the customer to contact their institution’s IT department, or whatever authority issued the Mac to them. The issuing authority has the means to obtain a token to unlock the device.

Follow these steps if the customer provides both a proof of purchase and ID associated with the institution that issued them the Mac.

A. Create a Service Non-Repair record with the customer's information by clicking “New Repair” and selecting “Service Non-Repair Case-NTF."  If you do not see the “Create repair" button and must go through the troubleshooting flow, the recommended process is to select Startup and power and Will not start up, then select Yes for the Quick Checks resolving the issue.

You will then be able to create a new Service Non-Repair record.

B. If the serial number is registered in GSX under an institution’s name, the customer must present a current form of ID connecting them with that institution.

C. For educational institutions, the representative of the school must present a current employee photo ID or other form of documentation connecting them with the current term of the school.

D. If the customer's ID is not available, or it cannot be determined that the ID is current, the customer will need to submit a letter from the institution, signed by a principal, officer, or manager, stating the firmware unlock request is permitted.

E. If the serial number is not registered in GSX under an institution’s name, use the guidelines for individuals above.

F. Follow these steps to request an EFI unlock:

1. Create a GSX Help escalation with Issue Topic “Technical Troubleshooting”, to upload the scanned POP document.
2. In the notes, include the form of ID used to verify ownership. Do not take a photograph of the customer's ID.
3. Once the request has been created, initiate a ACS Chat with Issue Category “EFI Password Reset”. Include the GSX Help escalation number in your pre-chat survey.
4. ACS will review the GSX Help escalation and provide the unlock file or request additional information. 
5. If you do not wish to chat, ACS will respond to the GSX Help escalation within 1-business day with the unlock file or a request for additional information.

Note: Submitting an EFI unlock request is a form of service. As such, Self-Servicing accounts should only submit unlock requests for products owned or leased by the Self-Servicing account as described in section 1.2, Program Requirements, of the Self-Servicing Account Program Manual.

 

3. Verifying proof of purchase

A. A valid POP from an Apple Authorized Reseller is a sales receipt or invoice that is legible. Each of the following criteria is required to determine a POP is valid:

• Product's original date of purchase
• Invoice or receipt number
• Product price
• Reseller name, address, phone number and, if possible, company seal or logo
• Product serial number (if possible, but not required)

B. The following items will not be accepted as a proof of purchase:

• An order acknowledgement
• An order confirmation
• Shipping documentation/packing slips
• Online auction documentation

4. When proof of purchase and ID documentation is not available, other options are available.

A. The MLB can be replaced out of warranty and:

• The data on the hard disk drive (HDD) must be securely erased using OS X Internet Recovery (HT204904)
• For a solid-state drive (SSD) the data must be securely erased using OS X Disk Utility (HT201949).

B. Deny service when the customer will not permit the erasing of the data.