Skip to main content
Open a support ticket and MacStadium makes the change for you. You can’t disable System Integrity Protection (SIP) yourself on a hosted Mac, because it can only be changed from recoveryOS, which needs local console access to the Mac. SIP changes are part of the Remote Hands service.

​
Request a SIP change

1

Open a ticket

Open a ticket in the MacStadium portal. If you need the change on several Macs, list all of them in one ticket.
2

Include an admin account for each Mac

On Apple silicon, recoveryOS asks for an administrator account before it allows the change. Include the admin username and password for each Mac, and select the sensitive information checkbox so the credentials are never sent by email.
Don’t paste passwords into chat or email. Use the ticket’s sensitive information checkbox, and change the password after the work is done.
3

Say what you need

Say whether you want SIP disabled or re-enabled. If you’re disabling it to load a kernel extension, say so in the ticket.

​
What to expect

  • Downtime. MacStadium shuts down the Mac and starts it in recoveryOS to make the change, so the Mac goes offline and SSH and Screen Sharing disconnect until it restarts. Save your work and stop any jobs on the Mac first.
  • Timing. The change itself takes a few minutes once a technician starts on the ticket.
  • Security policy. On Apple silicon, disabling SIP also lowers the Mac’s startup security policy.
To check the current setting, run csrutil status in Terminal on the Mac.

​
Reimage a Mac

You can also request a reimage, which erases the Mac and installs a clean copy of macOS. List every Mac in one ticket and say which macOS version you want.
A reimage erases everything on the Mac. Back up anything you need first.
A reimage takes longer than a SIP change: about 20 minutes to erase and 30 minutes to reinstall, depending on the macOS version and how many Macs are in the request. Plan for each Mac to be offline for at least an hour from when the work starts.

​
Orka VMs

This page is for MacStadium-hosted Macs. For Orka virtual machines, use an image with SIP already disabled. See SIP-disabled images in orka-images.