macOS startup options for administrators: Recovery, Startup Security Utility and Disk Utility First Aid

Goal

Start a Mac into a recovery or diagnostic mode and check or repair its startup disk, using only Apple's built-in tools and with the physical console in front of an administrator.

Prerequisites

Physical access to the Mac (or a remote-KVM equivalent that can send the required key/button sequences at power-on); an administrator account and its password for steps that require authentication.

Steps

1. Start up from macOS Recovery. Apple silicon: shut down, then press and hold the power button until "Loading startup options" appears; click Options, then Continue, and authenticate as an administrator if asked. Intel: press the power button and immediately hold Command (⌘)-R (Option-Command-R or Shift-Option-Command-R start Recovery over the internet). Recovery offers Restore from Time Machine, Reinstall macOS, Disk Utility, and Terminal and Startup Security Utility from the menu bar.
2. Startup Security Utility sets the startup-disk policy. On Intel Macs with a T2 chip the levels are Full Security (the default: the OS must be one Apple currently trusts), Medium Security (any Apple-signed macOS, no online check) and No Security; a separate setting allows or disallows booting from external media. On Apple silicon it sets Full or Reduced Security per macOS volume. Lower it only as a deliberate, temporary step and restore it afterwards.
3. Safe Mode: on Apple silicon, open startup options as in step 1, select the startup disk, hold Shift and click "Continue in Safe Mode"; on Intel, hold Shift right after power-on until the login window. It starts with only required kernel extensions and without some startup items, which helps separate third-party software problems from macOS or hardware ones. Undo it by restarting normally.
4. Check the disk with Disk Utility's First Aid, or in Terminal diskutil verifyVolume <volume> (check only) and diskutil repairVolume <volume>, which run the appropriate fsck for the file system. fsck_apfs -n /dev/<diskXsY> checks an APFS volume without repairing; run it on an unmounted volume (for example from Recovery). Repairs outside Recovery need sudo. If FileVault is on, unlock the volume first in Disk Utility (Mount) with a user password or the recovery key.
5. System Integrity Protection "restricts the root user account and limits the actions that the root user can perform on protected parts of" macOS (such as /System, /usr, /bin, /sbin), so even sudo cannot write there; csrutil status shows its state. Read nvram boot-args before changing anything; setting it needs sudo, and many boot arguments are refused or ignored under SIP or Full Security.
6. Reset NVRAM on an Intel Mac with Option-Command-P-R held at power-on; Apple silicon has no such key combination.

Expected result

The Mac reaches Recovery, Safe Mode or First Aid as intended; diskutil verifyVolume / fsck_apfs -n report the volume clean, or First Aid states what it repaired.

Limits and test basis

Key combinations and menu wording vary between Apple silicon and Intel Macs and across macOS versions; confirm the procedure for the specific model. Single-user mode (Command-S) is disabled in macOS Mojave and later. SIP's protected-path list and enforcement are version-dependent — treat it as "assume it blocks writes to system paths" rather than a fixed list.