APFS 'protect' flag won't remove on M1 Mac after migration

Hello everyone,

I'm trying to remove the protect flag from my DONNEES APFS volume. This appeared after migrating from an Intel Mac to an M1 Mac using a Time Machine backup.

Here is the current status:

  • mount output: /dev/disk3s7 on /Volumes/DONNEES (apfs, local, journaled, protect)
  • FileVault: No (Encrypted at rest)
  • No APFS snapshots (all deleted)
  • Permissions are correct (owner sc, uid 501)
  • Tried mount -uw, diskutil enableOwnership, remounting in Recovery mode — none worked

The protect flag blocks all write operations without password/Touch ID authentication, even though I am the volume owner.

Has anyone successfully removed the protect flag from a non-FileVault APFS volume after an Intel → M1 migration?

Thank you.

Context:

  • MacBook Pro M1, macOS (latest)
  • APFS volume DONNEES (disk3s7), 170 GB, no FileVault, "Encrypted at rest"
  • Volume migrated from Intel Mac via Time Machine backup
  • Problem: every write operation requires Touch ID / password authentication
  • mount shows: apfs, local, journaled, protect

What we tried:

  1. POSIX permissions — all folders were in dr-x------, fixed with sudo chmod -R u+w /Volumes/DONNEES → did not solve the issue
  2. com.apple.quarantine attribute — found on several files, removed with sudo xattr -rd com.apple.quarantine /Volumes/DONNEES/ → did not solve the issue
  3. Force remount — sudo mount -uw /Volumes/DONNEES → flag protect persisted
  4. APFS snapshots — 12 Time Machine local snapshots found and deleted with sudo tmutil deletelocalsnapshots → flag protect persisted
  5. Recovery mode — booted into macOS Recovery, tried:
    • mount -uw /Volumes/DONNEES
    • mount_apfs -o rw /dev/disk3s7 /Volumes/DONNEES
    • diskutil enableOwnership /Volumes/DONNEES
    • All returned protect flag still present

6 FileVault — confirmed off (FileVault: No), so diskutil apfs decryptVolume does not apply

Current status:

Write operations are blocked. The protect flag cannot be removed by any method tried, including in Recovery mode.


MacBook Pro 16″, macOS 26.5

Posted on Jun 15, 2026 10:19 AM

Reply
5 replies

Jun 16, 2026 6:22 PM in response to sébastien249

sébastien249 wrote:
 Hi HwTech,
How did you utilize your TM backup when setting up this new Mac?
Copy to DONNEES

@Barney-15E has you covered on the correct way to restore data from a TM backup.


You could also possibly "Get Info" on the "DONNEES" volume and select "Ignore Ownership". I don't think you mentioned this option previously. However, if this "works" I would be concerned that transferring the files the way you did could have introduced some other unforeseen issues since I don't fully understand the nuances of how the TM backup file structure works. It might be that some months/years down the road you may discover a problem that could be traced back to the improper restoration of data, but by that time it will be way too late to correct the mistake.

Jun 15, 2026 11:33 AM in response to sébastien249

FYI, my "Data" volume shows "protect" while I'm booted normally. I do not have Filevault enabled, although I do have an extra APFS volume within the same Container which does use an encrypted APFS file system. When I mount that encrypted APFS volume....it also shows "protect". So I don't think that is your problem.


How did you utilize your TM backup when setting up this new Mac?


I'm assuming the "DONNEES" APFS volume is an extra APFS volume and is not your "Data" volume renamed. Is this "DONNEES" volume just a plain old extra storage area outside of your macOS user account? It may help to see the output of the following Terminal command (I'm assuming the "DONNEES" volume is on the internal SSD...if not, then remove the " internal" part of the command):

diskutil  list  internal



Jun 16, 2026 12:18 PM in response to sébastien249

sébastien249 wrote:
.Has anyone successfully removed the protect flag from a non-FileVault APFS volume after an Intel → M1 migration?
MacBook Pro M1, macOS (latest)
• Volume migrated from Intel Mac via Time Machine backup
• Problem: every write operation requires Touch ID / password authentication
diskutil list internal
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *500.3 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 494.4 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3
/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +494.4 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD - Data 156.8 GB disk3s1
2: APFS Volume Macintosh HD 12.6 GB disk3s3
3: APFS Snapshot com.apple.os.update-... 12.6 GB disk3s3s1
4: APFS Volume Preboot 9.1 GB disk3s4
5: APFS Volume Recovery 1.3 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
7: APFS Volume DONNEES 170.7 GB disk3s7



you would suspect your user/admin user data Volume would be " Volume Macintosh HD - Data "...(?)



The most trouble free way to move to a new machine, is using the Setup Assistant on the initial boot of a brand new machine— you have one shot here, unless you start over: Set up your MacBook Pro - Apple Support


The second best way is use the Migration Assistant.

How to move your content to a NEW Mac: Transfer to a new Mac with Migration Assistant - Apple Support


Transfer your information to Mac from another computer or device:

Transfer your information to Mac from another computer or device - Apple Support




if necessary you can remove volumes from the Container if it got added in

Add, delete, or erase APFS volumes in Disk Utility on Mac - Apple Support


if necessary you can erase and try again:

Erase your Mac and reset it to factory settings




Jun 16, 2026 10:05 AM in response to HWTech

 Hi HwTech,

How did you utilize your TM backup when setting up this new Mac?

Copy to DONNEES


result :

diskutil  list  internal


/dev/disk0 (internal, physical):


   #:                       TYPE NAME                    SIZE       IDENTIFIER


   0:      GUID_partition_scheme                        *500.3 GB   disk0


   1:             Apple_APFS_ISC Container disk1         524.3 MB   disk0s1


   2:                 Apple_APFS Container disk3         494.4 GB   disk0s2


   3:        Apple_APFS_Recovery Container disk2         5.4 GB     disk0s3




/dev/disk3 (synthesized):


   #:                       TYPE NAME                    SIZE       IDENTIFIER


   0:      APFS Container Scheme -                      +494.4 GB   disk3


                                 Physical Store disk0s2


   1:                APFS Volume Macintosh HD - Data     156.8 GB   disk3s1


   2:                APFS Volume Macintosh HD            12.6 GB    disk3s3


   3:              APFS Snapshot com.apple.os.update-... 12.6 GB    disk3s3s1


   4:                APFS Volume Preboot                 9.1 GB     disk3s4


   5:                APFS Volume Recovery                1.3 GB     disk3s5


   6:                APFS Volume VM                      20.5 KB    disk3s6


   7:                APFS Volume DONNEES                 170.7 GB   disk3s7

APFS 'protect' flag won't remove on M1 Mac after migration

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.