Problems With T2 Security and External Boot Drives

Recently moved from a 2012 Mini to a 2018 Mini. The existing 2012 system has 6 bootable partitions, 5 of which were external USB based drives/partitions from various MacOS versions. I needed all the external drivers to work on the 2018 system, which has the T2 security chip.


The core OS that came on the 2018 model (10.14.5) worked fine. None of the external drive partitions would boot. This was the default case. It was also the case after the Secure Boot Utility was used to set Medium or No security and allow external boot drives. The drives would then begin the boot process, but eventually all resulted in various errors about the need for software/drive updates.


If you start with a bare drive, reformat, and then install a version of macOS, it works as a external boot drive. However trying to restore from a previously saved disk image doesn’t boot. Taking that same drive back to the 2012 Mini boots fine.


I had a number of different discussions with various Apple folks via support chat. The info there is varied and not consistent at all. It seems clear that few have dealt with T2 issues so far as it still quite new. Some said it wasn’t supposed to work at all with existing drives… and others said it was.


Apple has a document called “Apple T2 Security Chip Security Overview” from October 2018. It runs 15 pages or so and is fairly complex. There is clearly a lot going on here, but trying to figure out what is necessary to get an existing drive to boot is difficult at best.


My 2018 system does not have a firmware password enabled/used. The Secure Boot Utility does check for this. It also requires the normal admin password to continue. One this step is done, you can set the option for 3 levels of security (High, Medium, or None) and separately whether external drives are allowed at all for boot.


Any one else see this issue or have any thoughts on what’s going on? What are the steps needed to take an existing drive from an 2012 Mini and then get that to boot on a 2018 model?

Replies

Talked to an Apple guy today who was more knowable in this area and related things. He was able to shed some light on the different things going on here. Some is T2 related, some perhaps beta related, and some software related, and some documentation related.


It seems that a Mac system generally cannot boot a version of macOS earlier than the version that originally came installed. So a Mac that came with macOS 10.14…generally cannot boot versions 10.13 or earlier. My 2018 Mini came with 10.14 Mojave…so any boot attempts at Mavericks, Josemite, High Sierra, etc wont work. What seems very odd is that if you have earlier versions (I had 3), they will show in the Mojave Startup Disk selection area, will allow you to select them, will attempt to boot…and then fail with various error messages that are less than informative. It seems the system should know its limitations, either not show these options, or prompt with a message indicating the lack of any expected success. Seems some room for improvement.


The T2 based macs have a security boot utility that allows you to set external boot options. It has 3 levels of security…High, Medium, and none. If you read the docs on the None selection, there is nothing there to indicate that there might be other restrictions (like above) that would prevent boot. Clearly there are. There is room for improvement here in the documentation.


I had two of the 2018 Mini units. The first died about after 10 days. Before it went south I had successfully installed and run the first betas of Catalina. When the second 2018 unit arrived the SSD drive from the first with Catalina would also not boot. No clue of why. The Apple guessed it was beta related. The only way to get around that was to erase the disk and reinstall Catalina. That worked.