Fix csrutil disable Not Working on Mac M1/M2/M3/M4/Intel/T2

Disabling System Integrity Protection (SIP) on Mac is necessary when installing certain old software, customizing system settings, or troubleshooting problems with macOS. To do this, you must run the Terminal command "csrutil disable" in macOS Recovery Mode.

While the process is simple, "csrutil disable" may not work as expected. For instance, it may fail one of the following errors:

In this article, we'll offer solutions to fix csrutil disable not working on Mac.

What does csrutil disable do?

The csrutil disable command is used on macOS to disable System Integrity Protection (SIP). When you run csrutil disable, it turns off SIP, allowing the root user to modify protected files and directories, load unsigned kernel extensions, and perform other actions that SIP would normally block.

How to fix csrutil disable not working on Mac?

We summarized the common errors you may encounter when disabling SIP on Mac and the corresponding solutions.

csrutil This tool needs to be executed from the Recovery OS

The error "crutil: failed to modify system integrity configuration. This tool needs to be executed from the Recovery OS" occurs when you execute the command csrutil disable in regular mode. To disable SIP, you must boot into macOS Recovery Mode, then open Utilities > Terminal and run the command.

Suppose the message persists in macOS Recovery, then you can create a macOS bootable USB installer with iBoysoft DiskGeeker and boot the Mac from the external drive to turn off SIP.

csrutil disable command not found

If Terminal returns the error "csrutil: command not found," try a different way to enter Recovery Mode.

On an Intel-based Mac:

On an Apple Silicon M1/M2/M3/M4 Mac:

If you still can't disable SIP on Mac, try reinstalling macOS without formatting the internal hard drive.

csrutil disable authorized user

Sometimes, you'll be asked to enter an authorized user when running csrutil disable. If you get the message "Unknown user - try again!" after typing your username, it's usually because of the format of the username, for example, a space between your names. To fix it, change your username to a one-word name, then try disabling System Integrity Protection on Mac again.

csrutil: The OS environment does not allow changing security configuration options.

This message indicates you're not in the right macOS Recovery environment, which is essential for disabling SIP. If you're not in Recovery Mode, boot into it and retry.

If you're using csrutil disable on an M1/M2/M3/M4 Apple Silicon Mac, you might have accidentally booted into Fallback Recovery, which can't change the system security state. To resolve it, boot into the correct Recovery mode. Here's the difference between two recovery modes:

Recovery: Press and hold the power button.

Fallback recovery: Press, release, then press and hold the power button.

csrutil disable failed to update security configuration

If you receive the error "csrutil: Failed to update security configuration for "Macintosh HD": Failed to create local policy," you can reset the SIP configuration to its default state and try to disable it again.

Share these solutions to help others fix csrutil disable not working on Mac!