macOS asks for an account with a secure token before it lets you manage local users, for example to change a password or create a new account. This article explains which accounts get one, what it allows and how to give one to the Factorial IT admin account.
Overview
What a secure token is. It is a security identifier that macOS creates and ties to a local user account. It exists on macOS 10.13 and later, on APFS volumes.
The token is what lets an account encrypt and decrypt the disk with FileVault. macOS treats an account with a token as "authorised" for sensitive actions such as:
- Switching FileVault on or off
- Changing the password of another local user (if that user has a secure token)
- Creating a new local user
- Giving a secure token to another account
- Deleting a local user account
Without a token, these actions fail, even from an administrator account.
When the Mac starts, the FileVault unlock screen lists only the accounts with a secure token. An administrator account with no token cannot unlock the disk after a restart. It can sign in once another account has unlocked the disk.
An account with no token still behaves as a normal administrator once the disk is unlocked: sudo, installing apps, and settings not related to FileVault or startup security. MDM commands such as Lock and Wipe do not depend on this account and work in any case.
A secure token is granted, never moved. Several accounts on one Mac can each hold one. You never need to take a token from one account to give one to another.
Why it matters for Factorial IT
Factorial IT uses the secure token to manage macOS users safely. When you reset a password or create a user from the console, macOS needs an account with a secure token to carry it out. If no account on the Mac has one, the action fails.
Check the secure token status
- Open Devices and open the device details page.
- Go to the Users tab. The secure token status is shown there.
- Check that the macOS administrator account Factorial IT uses has an active secure token. User management only works properly if it does.
To check on the Mac itself, run:
sudo sysadminctl -secureTokenStatus <account>The console can take up to 24 hours to show changes to local accounts in the Users tab.
How to use: give a secure token to the Factorial IT admin account
Accounts created by the Admin management control get no secure token until they sign in once. You do this once per Mac.
- Check the bootstrap token. On the Mac, run:
sudo profiles status -type bootstraptoken
You need to see Bootstrap Token escrowed to server: YES. If it says NO, first follow Escrow a missing bootstrap token below.
- Get the admin password. On the device details page, open the Users tab. On the admin account card, click Actions > Display password and copy it.
- Sign in as the admin account from the Mac's login window, typing the password. SSH sessions, scripts run through Factorial IT,
suandsudodo not grant a token. - Check the result:
sysadminctl -secureTokenStatus <admin account>
You can sign out. The account keeps the token. The console shows the new status within 24 hours.
The console has no bulk action to give the token to the admin account on many Macs at once. On a large fleet, begin with Macs that have FileVault on and Macs with Apple silicon. On those, a missing token blocks unlocking at startup and software updates.
Grant or revoke a secure token on any account
Both commands run on the Mac itself.
To grant a secure token:
sysadminctl -secureTokenOn <target account> -password - -adminUser <admin account with a token> -adminPassword -To revoke a secure token:
sysadminctl -secureTokenOff <target account> -password - -adminUser <admin account with a token> -adminPassword -The - tells sysadminctl to ask for each password, so they stay out of your shell history. Never put these passwords in a ticket or a chat.
Either way, you need the password of the account you are changing and the password of an administrator account that already has a secure token. Apple requires this: sysadminctl always asks for the name and password of an existing administrator with a token. It cannot be done remotely without those passwords.
Every Mac must keep at least one account with a secure token. If you revoke the last one, nobody can unlock the disk at startup and the Mac is locked out.
If no account with a token is left, only the FileVault recovery key unlocks the disk. You find it on the device details page, under Information > Host information > Recovery key.
sysadminctl and System Settings both stop you deleting the last administrator or the last account with a secure token.
Bootstrap token and volume ownership
The bootstrap token lets macOS give a secure token at first login, without anyone typing credentials by hand. Apple describes it like this:
- On macOS 11 and later, the very first user whose password is set on the Mac gets a secure token.
- On macOS 11 and later, if an account gets no token when it is created and the device management service holds a bootstrap token, macOS grants the token when that user signs in.
- On macOS 10.15.4 and later, macOS creates a bootstrap token and escrows it with the device management service the first time any account with a secure token signs in, if the service supports it.
On Macs with Apple silicon, the secure token also decides volume ownership. Volume owners control startup security settings and authorise software updates and erasing all content and settings:
- The person who first set the Mac up for their own use gets a secure token and becomes the first volume owner.
- When a bootstrap token is available and in use, it is also a volume owner. As it grants secure tokens to other accounts, it makes them volume owners too.
To see the volume owners and the bootstrap token state on the Mac:
sudo diskutil apfs listUsers /
sudo profiles status -type bootstraptokenlistUsers lists volume owners by GUID. To find which account a GUID belongs to, search for its GeneratedUID:
dscl . -search /Users GeneratedUID <GUID>Escrow a missing bootstrap token
If profiles status shows escrowed to server: NO, run this on the Mac using an account that already has a secure token, normally the Mac's main user:
sudo profiles install -type bootstraptokenIt asks for that account's name and password. Run profiles status -type bootstraptoken again to confirm.
Which accounts get a secure token (macOS only)
| How the account was created | Admin account | Non-admin account |
|---|---|---|
| Created by Factorial IT during Zero Touch deployment | Secure token switched on automatically | No secure token |
| Created automatically by the Admin management control | Secure token granted at the account's first login, if a bootstrap token is escrowed (1) | No secure token |
| Created by you through Factorial IT | Secure token granted at the account's first login, if a bootstrap token is escrowed (1) | No secure token |
| Created by you on the Mac | Secure token if created from an admin account with a token | No secure token |
Created by you with sysadminctl, on the Mac or remotely |
Secure token if created with an admin account that has a token | Secure token if created with an admin account that has a token |
(1) Without an escrowed bootstrap token, the first login does not grant a token. See Escrow a missing bootstrap token.
In the Users tab, accounts created by the Admin management control show Source: MDM Control. Other accounts show no source.
Tips and Best Practices
- Check the bootstrap token first. Most missing tokens come down to a bootstrap token that was never escrowed.
-
Sign in at the login window. SSH, scripts,
suandsudonever grant a token. - Prioritise FileVault and Apple silicon Macs. That is where a missing token blocks startup unlock and updates.
- Never revoke the last token on a Mac. Keep at least one account with a secure token.
-
Keep passwords out of history and chats. Use
-sosysadminctlasks for them. - Allow up to 24 hours. The console takes that long to show a new status.
Troubleshooting and FAQ
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Granting a token fails on the administrator credentials | The administrator account you used has no secure token itself | Check with sysadminctl -secureTokenStatus, then run the command again with an account that has one |
| An account has no token although the Mac is managed | It was created without a token and has not signed in yet | Sign in once with that account at the login window, then check again |
| Still no token after signing in | No bootstrap token is escrowed, or the sign-in was not at the login window | Check profiles status -type bootstraptoken, escrow the token if needed, then sign in again at the login window |
| The Factorial IT admin account is missing from the startup screen | It has no secure token, so FileVault does not list it | Unlock the Mac with the main user, then give the admin account a token |
| The account with the token is not an administrator | Another user set up the Mac first and got the first secure token | Use that account as -adminUser to grant tokens, making it an administrator first if needed |
FAQ
-
Can a secure token be moved from one account to another?
No. It is granted, not moved. Several accounts can hold one at the same time.
-
Can I grant a token remotely from the console?
No. Apple requires the passwords of the account and of an admin with a token, on the Mac itself. For the Factorial IT admin account, a login at the login window is enough.
-
Do Lock and Wipe need a secure token?
No. MDM commands like these work either way.
-
What if no account has a token left?
Only the FileVault recovery key can unlock the disk. Find it under Information > Host information > Recovery key on the device details page.