[iMore Question]

My sons MacBook was stolen a few weeks ago.
He searched through Find my iPhone-app but of course it was offline.
He then gave the command to blok the MacBook the moment it would be online, since there was some confidential material in it.

Only yesterday he received an email informing his MacBook was blokked. Obvisously only yesterday somebody tried going online.
He tried to look for his Mac through Find my iPhone but without luck.
Any suggestions?
Will the unrightful holder be able to use the MacBook?

[anon(9602380)]

My son’s MacBook was stolen a few weeks ago.
He searched through “Find my iPhone”-app but of course it was offline.
He then gave the command to blok the MacBook the moment it would be online, since there was some confidential material in it.

Only yesterday he received an email informing his MacBook was blokked. Obvisously only yesterday somebody tried going online.
He tried to look for his Mac through “Find my iPhone” but without luck.
Any suggestions?
Will the unrightful holder be able to use the MacBook?

So sorry to hear about your sons MacBook.

As for the person who is in possession of the MacBook, it will be useless to them. They will need your sons Apple ID and Password to unlock the MacBook. If you are really concerned about confidential info, my suggestion would be to do a Remote Wipe instead of just blocking it. This will erase the HDD should they try turning it on again. If you do this though, I hope you have a backup of the HDD.

As for the person in possession, they have a great paperweight for now.

[SirMP]

Thank you for your comment.
Should my son still be able to find the MacBook through Find my iPhone when online although it is blocked?
Do I understand correctly? Is the MacBook useless? Even if it is opened up and the HDD is replaced?
How do I do a "Remote Wipe"?
I doubt my son will ever see his MacBook again so whether he made a backup or not ...

[Just_Me_D]

Thank you for your comment.
Should my son still be able to find the MacBook through Find my iPhone when online although it is blocked?

The Find My device feature only works when the device is online. You can keep trying to locate it, if you'd like, but since you don't know who has it or his or her knowledge of the feature, there are no guarantees you'll get it back.

Do I understand correctly? Is the MacBook useless? Even if it is opened up and the HDD is replaced?

Yes

How do I do a "Remote Wipe"?
I doubt my son will ever see his MacBook again so whether he made a backup or not ...

You can remotely wipe the MacBook via the Find my iPhone app, however, remotely wiping it should done as a last resort in my opinion. Locking the MacBook remotely should be sufficient.

https://support.apple.com/kb/PH2700?...ewlocale=en_US

[SirMP]

Thanks for your comments. Aappreciate it.

[Ariel Babalao]

The only way who ever found the MacBook will not be able to by pass the lock screen will be only an only if the owner of the MacBook have setup a firmware password into the MacBook. A firmware password is store into a dedicated tiny memory in the CPU of new models MacBooks (2012, 2013, 2014, 2015 generations of MacBooks). Then whenever the CPU noticed that the main storage changes, it trigger the request to enter the Firmware password before grant access any further into booting up the computer.
If the owner of the computer have never set up the Firmaware password, any well award person can easily get into the computer and use it, simply by changing the SSD into a new one. Having setup find my Mac, and/or lock screen password will not help much if the internal storage is swapped out.
In case you didn't know about Firmware password protection, I highly advice you to read about it and have it set up on your Apple computers next time. Hackers can still pass by firmware password, because it's technology but, they will have such a hell of hard time cracking the CPU, specially the most recent ones.

[Just_Me_D]

The only way who ever found the MacBook will not be able to by pass the lock screen will be only an only if the owner of the MacBook have setup a firmware password into the MacBook. A firmware password is store into a dedicated tiny memory in the CPU of new models MacBooks (2012, 2013, 2014, 2015 generations of MacBooks). Then whenever the CPU noticed that the main storage changes, it trigger the request to enter the Firmware password before grant access any further into booting up the computer.
If the owner of the computer have never set up the Firmaware password, any well award person can easily get into the computer and use it, simply by changing the SSD into a new one. Having setup find my Mac, and/or lock screen password will not help much if the internal storage is swapped out.
In case you didn't know about Firmware password protection, I highly advice you to read about it and have it set up on your Apple computers next time. Hackers can still pass by firmware password, because it's technology but, they will have such a hell of hard time cracking the CPU, specially the most recent ones.

I read about it a while ago, and you're absolutely right...

[SirMP]

Hi Ariel Babalao,
When you write about the "firmware password", do you mean the password needed when for example the screen went down after not using the laptop some minutes? or when installing a new software application or a new update to an application in use?

[Ariel Babalao]

Hi Ariel Babalao,
When you write about the "firmware password", do you mean the password needed when for example the screen went down after not using the laptop some minutes? or when installing a new software application or a new update to an application in use?

No. Firmware password is setup up out of the GUI, that is as soon as you boot up the computer, press command + r keys to boot into recovery mode. Then you enter the OS X Utility, that is where you can set up the Firmware password which will be save into the CPU.
By trying to reach the recovery mode now that I have Firmware password is enable on my computer, I can't access it until I enter the Firmware password where by i could still access recovery mode if there was no Firmware password but lock screen password (the one you are talking about). Lock screen password simply protect your GUI. Think of it like "find my iPhone" and "lock screen pass word" on iPhone. Where Firmware password act like find my phone and lock screen password act like lock screen password.
Here are some screen shoot so to find there is the Firmware password after you press command+r as soon as you boot up the computer.

[Ariel Babalao]

Then anyone who will try to do a recovery will be ask to enter the Firmware password.
If the CPU notice that the storage drive has change, the Firmware password becomes even aggressive and not only you will enter the firmware password, but you will also have to authenticate that you are the owner by entering your iCloud password (that is if you select that option when setting up Firmware password)
Basically, with firmware password, there is almost no chance for even a tech savy guy to by pass Firmware password when both Firmware password and iCloud recovery password is enable in the computer. Even stronger than the way "find my iPhone" act when it's enable.
After setting up Firmware password, bellow image showing how it request password for anything you will want to do off GUI.
Please do note that if you do not secure your internal hard drive with FileVault, anyone can physically remove it, have access to your data, thus to keychain and retrieve your firmware password from keychain. Keychain exist to store your password and allow you to retrieve your password should you forget it. Keychain only rely on your GUI password, encrypting your internal hard drive is a good thing just in case.

[SirMP]

Wow! This is a lot of info. I am going to study this thoroughly. Although I think I will have to get back to you for some more help. Thanks a lot for now.

PS: What does GUI and CPU stand for?

[Ariel Babalao]

Wow! This is a lot of info. I am going to study this thoroughly. Although I think I will have to get back to you for some more help. Thanks a lot for now.

PS: What does GUI and CPU stand for?

No worries if anything I can help with.
GUI is the "Graphic User Interface" that is the user interface you use to work in, you will see the status bar, the doc bar, the folders or items on your desktop, application folder, applications etc... You work in that environment base on graphic unlike in terminal where you have no graphic.
CPU is the "Central Process Unit" which is the main brain of your computer.