How to Use the bioutil Command in macOS Terminal to Manage Touch ID Biometrics and Pairing Policies

Touch ID on Apple Silicon and Intel MacBooks provides seamless biometric security, allowing users to unlock accounts, authorize Apple Pay transactions, and approve administrative tasks with a fingerprint touch. In enterprise IT administration, automated provisioning, and developer environments, configuring these biometric authentication policies manually across multiple System Settings screens is inefficient.

macOS includes a dedicated, native command-line utility for managing biometric subsystems: bioutil. Located in /usr/bin/bioutil, this tool queries biometric capabilities, configures user-level and system-wide Touch ID flags, audits enrolled fingerprint counts, and resets sensor pairing caches. This guide explains how to audit and configure biometric authentication in macOS using bioutil.

Understanding bioutil Scope and Privilege Levels

The bioutil utility operates across two distinct configuration scopes:

• User Scope (Default): Applies exclusively to the currently authenticated user account. Requires standard user privileges.
• System Scope (-s flag): Governs global machine policies across all local user accounts. Modifying system-wide flags requires administrative elevation via sudo.

Command Syntax and Options

The standard syntax for bioutil is:

bioutil {-r | -w} [-s] [-f {0 | 1}] [-u {0 | 1}] [-a {0 | 1}] [-c]

Key Parameter Flags

• -r (Read): Queries and displays current biometric configuration policies.
• -w (Write): Modifies the specified biometric policy flags.
• -s: Directs operations to system-wide scope rather than user scope.
• -u {0 | 1}: Enables (1) or disables (0) Touch ID for user account unlock.
• -a {0 | 1}: Enables (1) or disables (0) Touch ID for Apple Pay authorization.
• -c: Returns the total count of enrolled fingerprints for the targeted scope.
• -p: Purges enrolled biometric templates from the Secure Enclave (administrative action).

Step-by-Step Administrative Operations

1. Auditing Current Biometric Policies

To inspect active Touch ID policies for your current user profile:

bioutil -r

Sample output:

User-level biometric functionality:
    Unlock with Touch ID: 1
    Apple Pay: 1

To query system-wide policies enforced across all accounts on the Mac:

bioutil -r -s

2. Checking Enrolled Fingerprint Counts

Before automating security workflows, verify whether a user has registered fingerprints in the Secure Enclave:

bioutil -c

Output:

User-level biometric enrollment count: 2

This confirms that two fingerprints are registered for the current user.

3. Disabling Touch ID for Account Unlock via Command Line

If corporate compliance requires password-only unlock while permitting Touch ID for secondary authorization, disable the unlock flag:

# Disable Touch ID for current user unlock
bioutil -w -u 0

# Disable Touch ID for unlock globally across all users
sudo bioutil -w -s -u 0

4. Enabling Touch ID for sudo in Terminal

While bioutil controls core system unlock flags, pairing Touch ID with Terminal sudo commands streamlines developer workflows. Edit the PAM authentication configuration:

sudo nano /etc/pam.d/sudo

Add the following line directly below the initial comment:

auth       sufficient     pam_tid.so

Save (Ctrl + O) and exit (Ctrl + X). Now, running any sudo command prompts for a Touch ID fingerprint scan instead of a password.

bioutil Policy Configuration Matrix

Administrative Goal	Command Execution	Privilege Required
Audit user Touch ID status	bioutil -r	Standard User
Audit system-wide Touch ID status	bioutil -r -s	Standard User
Count enrolled fingerprints	bioutil -c	Standard User
Disable Apple Pay biometrics globally	sudo bioutil -w -s -a 0	Administrator (sudo)
Re-enable Touch ID account unlock	bioutil -w -u 1	Standard User

Troubleshooting Sensor and Enclave Pairing

• Touch ID Sensor Unresponsive: If the physical Touch ID button fails to register input after sleep, restarting the CoreAuth biometric daemon resets the connection without rebooting: sudo killall biometrickitd.
• Hardware Mismatch: On external Apple Magic Keyboards with Touch ID, biometrics only function over secure Bluetooth or Lightning/USB-C connections paired with Apple Silicon Macs. Intel Macs do not support Touch ID over external wireless keyboards.