2016 MacBook Pro: System Integrity Protection (SIP) Disabled as Shipped by Apple

Mac wish list • all 2016 MacBook pro models at B&H Photo • all 15" Apple MacBook Pro 2016 models • all 13" Apple MacBook Pro 2016 models. MPG gets credit if you buy through those links.

In a troubling slip-up, Apple has shipped at least some 2016 MacBook Pros with System Integrity Protection (SIP) disabled, which exposes the MBP to malware and other threats.

The MPG MacBook Pro shipped with SIP disabled:

MacBook-Pro:~ lloyd$ sudo csrutil status
Password:
System Integrity Protection status: disabled.

√ MPG tested and verified this fix as follows

The fix is to boot into recovery mode (cmd-R at startup), then do 'csrutil enable'.

As shown below, the MacBook Pro was booted into recovery mode, then Utilities => Terminal was chosen. See the 'csrutil enable' command near bottom.

Rebooting, SIP is confirmed enabled:

MacBook-Pro:~ lloyd$ sudo csrutil status
Password:
System Integrity Protection status: enabled.

Using csrutil to enable System Integrity Protection (SIP)