It seems like they didn't want to add a backdoor to the OS just for the sake of repairs.

Yes, the front door will do fine /s

Literally that. I think the policy is that users should set up a seperate admin account.

They asked me for this as well and said it was for diagnostics to confirm the repair was a success. You can decline politely with no problems.

That’s why you encrypt _your_ user account and add a “service account” for the Geniuses.

There are a lot of things that employees in the retail stores do that isn't very "Apple". I suspect that's partially from not having as strong culture fit selection in hiring, partially from lack of understanding (when it comes to security, it's a nuanced subject) and partially from the realities of being productive in a retail environment.

the form was an official Apple form for repairs. they are going to replace my keyboard and screen. they said they needed the password to test. I asked why not just boot from a USB drive and they said they could not do that. I didn't ask why they couldnt just swap a drive for testing.

they didn't offer this option I had to suggest it but basically I'll have to reformat the drive before taking it in for service.

Create a separate account for them, and make sure you have FileVault turned on so your home folder is encrypted.

I've managed to get this concept across to authorised repairers who don't speak english (and I don't speak Thai).

I hate to break it to you, but unless you store your home folder on a separate encrypted partition (which would be really inconvenient), this won't work.

FileVault 2 encrypts your entire boot volume, so there's no separate encryption of your home folder going on. If you give someone any of the passwords that unlock the boot volume, they could get all of the data off it (by using target disk mode or booting to single user mode, etc.)

Exactly. Or just enable the guest account. That's what I always do.

I assume they might want admin permissions honestly.

Having said that, prior to my recent visit (failing mbp fan) my trips had always been for failing/failed discrete graphics (about 5 trips on 2 different generations of 17" mbp) so a reinstall is inevitable because making macOS work properly after a mainboard replacemnt is more work than reinstalling from scratch

It so easy to get admin rights on a Mac anyway.

- Boot into single user mode...

# mount -uw /

# rm /var/db/.AppleSetupDone

# reboot

Reboot the machine and it walks you through a re-run of setting up the OS X set up assistant, which allows creation of an admin account.

whats the point of having branded stores then?

Store? I think you mean Apple Town Square.

Can't wait until they build this into the auto-correction...

It is a feature of privacy that he cannot login without you giving that information.

You need to change it now.

You should email Tim Cook ([email protected]), and see what he says about that.

Well I guess the debate is settled then.