You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Should "XProtect" be unchecked and requesting permission on 12.6 fresh install?

I had to 'restore' an M1 Mac mini (2020) because of its firmware becoming corrupted or some muchness.

All went well using Apple Configurator 2 in which it wrote the newest firmware out as well as installing Monterey 12.6 which did not need an update after first boot. Nice.


Now however, XProtect shows up as requesting Full Disk Access with it being unchecked of course.


This is simply in followup after finding a question asked when 12.4 was out for the exact same thing. No answer from Apple. A few responses from what appear to be some type of apple trolls about Macs not being able to get viruses and that's it.



Mac mini, macOS 12.6

Posted on Oct 13, 2022 7:53 PM

Reply
Question marked as Top-ranking reply

Posted on Oct 13, 2022 8:19 PM

Hello,

It's up to you whether you want XProtect to have full disk access or not. By default, it is turned off but XProtect is still able to search your Mac for malware. You can learn more about how Mac protects you from malware here: Protecting against malware in macOS - Apple Support


Thanks for reaching out!

-Drake

Similar questions

4 replies
Question marked as Top-ranking reply

Oct 13, 2022 8:19 PM in response to bill_1102inf

Hello,

It's up to you whether you want XProtect to have full disk access or not. By default, it is turned off but XProtect is still able to search your Mac for malware. You can learn more about how Mac protects you from malware here: Protecting against malware in macOS - Apple Support


Thanks for reaching out!

-Drake

Oct 16, 2022 3:38 AM in response to bill_1102inf

Part 1 of 2


There are no known Windows-like Viruses in the wild that self replicate and affect macOS, because of the underling UNIX  Foundation and Permission Limitation. 


Additionally, and specific to Big Sur macOS 11 and Monterey macOS 12, the Operating System resides in a Sealed and Read Only Volume that can not be opened by the User and protects against from “ Bad Actor “ Software.


The The Built in Security  is all that is required to protect the computer.


There is Adware & Malware which will affect the computer and is generally downloaded from “ Shady “ Websites or Developers who Inject this software into the download.


Should “ Certain & Specific Software “ referenced from above be installed - it will negatively impact macOS. It is suggested, download directly from the Developer , the application Malwarebytes for Mac


It is free or paid for added features. 


Run the Application and it should remove the malware / adware. Once done, restart computer and test.


Part 2 of 2


The Only thing this Antivirus software is protecting is the Bank Account of the Developers and for zero return to the User aside from the problems this software creates.


AntiVirus Developers purposefully Market their product to create a “ Fear Factor “. In so doing, creating a False Need for their Product.


Certain Applications maybe available on the Apple Apps Store - this only means the Developer is prepared to pay Apple a portion on each sale. What the Application may do to the computer is up to the User to check this out before purchase


Any of the below should be removed as per Developers Instructions 


This will include CleanMyMac , This will include BitDefender


This will included Norton Antivirus , Sophos Av Software


Intego AntiVirus, McAfee, MacKeeper, Avast AntiVirus


Ad Guard, Webroot , ESET , Avira 


AVG AntiVirus  


Trustee  


Read some of the posting and arrive at your own conclusions.




Oct 16, 2022 1:09 AM in response to drake211

Thank you for the link to the information but you completely failed to answer my question.


Should an apple version of XProtect even need to ask permission to do any of the things that the long and informative * article explains very clearly. The answer of course is duh- no. So why is a file 'called' XProtect asking for permission suddenly? And why when scanned with a malware tool does the bundle that it is has an "EICAR Test File (Not a Virus)" somewhere in it. Malware pretends to be system software with some regularity, no?> Macs don't get virus nonsense.

So other than the 'test file' package requesting permission where none is needed, AEServer would also like in on this game, along with MDM launching from launchd running something and then wiping itself from the logs as if it never even happened. Imagine this. Sorry I haven't had time to read the entire history of BSD OS raw code at the machine level to understand and neither have most people that read forums like this. The terminal window has no user history, no console user even logged in , while in the terminal. Never seen that before. no idea what it means.


XPROTECT / Notary Republic / MDR / MAR / SOUI are all doing a great job doing something else I guess than 'protecting' this system. Par for the course I guess, let me know when its over ok? Thanks


Oct 16, 2022 5:48 AM in response to bill_1102inf

Can you take a step back and clarify what you are asking about? In you first post you asked about XProtect showing up in the Full Disk Access list. That’s totally normal.


But now, you are dating that XProtect is asking for permission to do something? That’s extraordinarily unusual.


And you are asking about some third party tool that has a file called “EICAR Test File (Not a Virus)”? You would have to direct that question to the developers of said tool. You haven’t even told us what tool that is. It is quite dangerous to go downloading “security” tools. The industry is full of scams and even a few malware apps.


In fact, it is extremely unusual for malware to pretend to be anything other than malware. It is ridiculously easy to spot. Curious, eh?


To reiterate, it is perfectly normal to have XProtect listed in Full Disk Access. If you have a follow up question, please be specific.

Should "XProtect" be unchecked and requesting permission on 12.6 fresh install?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.