How to disable Boot Camp and prevent any other OS installations?

Is it possible to completely block the use of Boot Camp such that the current Mac OS installation is the only OS available to use? This is for T2 security chip enabled Macs specifically.

I found this page: About Secure Boot

I think the option to "Disallow booting from external media" takes care of scenarios where one could boot from a Linux live USB drive. But the "Full Security" option seems to indicate that Windows installed via the Boot Camp Assistant would still be considered secure or signed...? I want to know, if there is an option to block that avenue of installation as well; so effectively disabling Boot Camp.

If one were to set a firmware password, would a user be prompted for it every time when trying to boot into Windows? Like how this question may indicate: Booting into Windows partition prompts for firmware password. I am wondering if setting the firmware password is enough? For my specific scenario, the key is to prevent booting into another OS. I am OK if someone tried to install Windows via Boot Camp Assistant, but then became thwarted by the firmware password when trying to boot into Windows for the first time.

Solution 1:

If you do not want an user installing operating systems, then you would create a standard account for the user. In this case, the Boot Camp Assistant application can not be used to install Windows without first entering an administrator username and password. This is shown below for Big Sur.

The rest of this answer assumes the following. See About Secure Boot for more information.

• Firmware password protection is on.
• Secure Boot is set to Full Security.
• External Boot is set to Disallow booting from external media.

The firmware password is not required in the following cases:

• Selecting Restart in macOS… from the menu produced by clicking of the Boot Camp icon in the notification area on the right side of the Windows taskbar.
• Selecting macOS from the Boot Camp Control Panel in Widows.
• Selecting your Boot Camp volume in Startup Disk preferences of the macOS System Preferences application. However, this does require the password of an administrator.

The firmware password is required in the following cases:

• Before using the Mac Startup Manager to choose the Windows (Boot Camp) volume.

• Before using Mac Startup Manager to choose any macOS volume.

In other words, the firmware password is require only if the selection of a operating system is done using the firmware. The Mac Startup Manager is implemented in the firmware.

If one were to set the firmware password, the user would not necessarily be prompted for the password every time when trying to boot into Windows. The password is only asked for, when the Mac Startup Manager is involved.

If someone installed Windows via the Boot Camp Assistant, they would not be asked for the firmware password when trying to boot into Windows for the first time. They would not be asked after the first time either. Windows actually restarts (reboots) several times during installation.