SideMini

Security

Headless Mac mini, FileVault and automatic login: what actually happens at boot

SideMini3 min read

Everyone who runs a Mac mini without a monitor eventually hits the same wall: it boots, and then nothing happens. No Screen Sharing, no Sidecar, no scheduled jobs. The Mac is waiting for you at a screen you cannot see. Understanding the boot sequence explains why, and shows the three honest ways around it.

The boot sequence, in order

1. Firmware. The Mac powers on and loads macOS from the internal SSD.

2. FileVault unlock (if on). The disk is encrypted; macOS shows a pre-boot login screen and waits for a password. Nothing else runs. On Apple silicon this screen is drawn even with no display attached, so a keyboard works blind.

3. Login window. With the disk unlocked, macOS starts and shows the login window, unless automatic login is on, in which case it logs the chosen user in directly.

4. Your session. Only now do login items, launch agents, Screen Sharing and Sidecar exist. SideMini starts here, within seconds.

So the question “why doesn’t my app run at boot?” always has the same answer: because steps 2 or 3 are waiting for a person.

Why FileVault and automatic login cannot both be on

Automatic login works by storing your password in a root-only file so macOS can log you in without asking. FileVault’s entire purpose is that the disk cannot be read without the password. Storing the password on the disk to unlock the disk would defeat it, so Apple disables automatic login whenever FileVault is enabled, and vice versa.

Three ways to get to the desktop

A. Fully automatic: FileVault off, automatic login on. The Mac boots straight to your desktop and everything starts. Cost: anyone with physical access can power it on and reach your files. Apple silicon still encrypts the SSD in hardware, but the login password no longer protects the data at startup. Reasonable for a Mac in your own home that holds nothing sensitive; wrong for a laptop or an office machine.

B. Keep FileVault, plan your restarts. sudo fdesetup authrestart restarts the Mac and unlocks the disk once, without showing the pre-boot screen. Perfect for updates and deliberate reboots. Useless after a power cut.

C. Keep FileVault, type blind. Power on, wait about 40 seconds, type your password on an attached keyboard and press Return. Two attempts usually cover a typo. Free and secure, mildly annoying, and it requires you to be at the machine.

What SideMini does about it

SideMini’s “Only use iPad screen” mode is option A, made explicit. Turning it on shows the security warning, asks for your confirmation and an administrator password, and then asks macOS to turn FileVault off and automatic login on. Turning it off disables automatic login and leaves FileVault as it is. “Reset to Default” turns FileVault back on. Nothing changes just because the app is running or Settings is open.

For options B and C, the app just does its job once you reach the desktop; Settings → Advanced has a copy button for the authrestart command.

Reducing the risk of option A

  1. Turn on “Lock Mac after the first iPad connection” so the desktop is behind the lock screen within seconds of boot.
  2. Use a separate, low-privilege user for the unattended session if the Mac also holds sensitive data.
  3. Keep Find My and Activation Lock on; a stolen Mac is still a brick to resell.
  4. Enable “Start up automatically after a power failure” so the Mac recovers without you.
  5. Reassess when the Mac moves: a Mac mini that travels deserves FileVault back on.

Sources

SideMini is the small menu bar app that makes your iPad the screen of a Mac mini and connects it at every boot. Try it free for three days; $9 once, no subscription.

Keep reading