You can administer Open Firmware or EFI passwords to ensure the security of managed computers.
There are two ways to set and remove an Open Firmware/EFI password: using a policy or using Casper Remote.
The “setregproptool” binary must be present on each computer and any alternate boot volume(s) used to set firmware. For models “Late 2010” or later with macOS 10.9.x or earlier, the binary must be obtained and placed on the computer. (For more information, see the Setting EFI Passwords on Mac Computers (Models Late 2010 or Later) Knowledge Base article.)