How do you disable Siri permanently on macOS Sierra (10.12.6)? [duplicate]

I work in security as an intern, and I've been asked by my boss to look into disabling Siri on macOS Sierra. I noticed that there's no way to prevent users from re-enabling Siri even if it's disabled by an administrator.

I've tried using "csrutil disable" in Recovery Mode and editing Siri's .plist files, but it seems to have no effect. Is there any way to completely prevent any user from running Siri on macOS Sierra?

Solution 1:

It is not my work but Rich T. has a great post on this at his blog:

https://derflounder.wordpress.com/2016/09/20/blocking-siri-on-macos-sierra/

You will need to deploy two separate configuration profiles, the relevant keys are below:

Domain: com.apple.assistant.support.plist 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" 
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Assistant Enabled</key>
    <false/>
</dict>
</plist>

and

Domain: com.apple.Siri.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" 
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>StatusMenuVisible</key>
    <false/>
    <key>UserHasDeclinedEnable</key>
    <true/>
</dict>
</plist>

Depending on how you manage your macs, and how you want to deploy these profile settings they may need to be constructed differently.

As far as I know these two profiles are the only way to disable this.

Here is a link to the mobileconfig profiles for these settings. You can deploy them with any MDM:

https://github.com/rtrouton/profiles/tree/master/DisableSiri

Otherwise you will need to use defaults write:

defaults write com.apple.Siri StatusMenuVisible -bool false
defaults write com.apple.Siri UserHasDeclinedEnable -bool true
defaults write com.apple.assistant.support 'Assistant Enabled' 0

Once you make these changes you will need to clear the preference cache:

sudo killall -HUP cfprefsd

And then restart the WindowUI server:

sudo killall SystemUIServer

Hope this clarifies.

Solution 2:

I figured it out with the help of Edward S.

First, you need to reboot into Recovery Mode and run the command

csrutil disable

to turn off System Integrity Protection, which will allow you to edit all plist files.

Then, after rebooting, run the following:

sudo defaults write /System/Library/LaunchAgents/com.apple.Siri.plist Disabled -bool true
sudo defaults write com.apple.Siri StatusMenuVisible -bool false
sudo defaults write com.apple.Siri UserHasDeclinedEnable -bool true
sudo defaults write com.apple.assistant.support 'Assistant Enabled' 0

to set system defaults and

defaults write com.apple.Siri StatusMenuVisible -bool false
defaults write com.apple.Siri UserHasDeclinedEnable -bool true
defaults write com.apple.assistant.support 'Assistant Enabled' 0

for every user currently on the Mac. Future users will copy the system defaults.

Then run

sudo killall -HUP cfprefsd
sudo killall SystemUIServer
sudo reboot now

Go back into Recovery Mode and run

csrutil enable

Reboot, log back in again, and try to run Siri. The process will run, but it won't do a thing.

Solution 3:

It turns out an entirely different solution to what I expected is what actually works. It doesn't require you to change any settings at all. Simply reboot into Recovery Mode, open a terminal, and type:

csrutil disable

to disable System Integrity Protection. Reboot as normal, and then run

sudo rm -rf /System/Library/CoreServices/Siri.app

to disable Siri. Try to run it and you'll see it won't work. But we're not done yet. MAKE SURE to re-enable System Integrity Protection by rebooting one more time into Recovery Mode and running:

csrutil enable

and then rebooting.

Congratulations! You've just disabled Siri!

In the case that this doesn't work, implement both this and the .plist modifications I mention in my earlier answer.