Admin management creates a local administrator account on your Macs and Windows PCs, with a random password for each device and an option to remove admin rights from other accounts. Use it to keep a known admin account on every device under your control.
Feature/Functionality
Overview
| macOS | Windows | Linux | iOS / iPadOS | Android |
|---|---|---|---|---|
| ✅ | ✅ |
How to use
- Go to MDM > Controls > Add new control and choose Admin management.
- Type the username of the admin account to create.
- Pick the password type:
- Random password: a different password for each device. Recommended.
- Fixed password: the same password on every targeted device.
- If you want, switch on Automatically demote non-compliant admin accounts. Every other admin account on the device becomes a standard account. Temporary admin rights are removed as well.
- Choose where the control applies: all devices, specific device groups, or a custom target.
How it works on macOS
The control creates a local admin account and keeps its password in the Factorial IT console.
The account already exists. If the device already has an account with that username and Factorial IT did not create it, Factorial IT takes it over instead of creating a new one. The control shows it as created, but Factorial IT does not know its password, so Display password is not available. To have Factorial IT set and store the password, add an Admin password rotation control for the same username.
Removing admin rights. You cannot remove admin rights from an account that is the only one holding a SecureToken on the Mac. A SecureToken is a macOS access key needed to switch on FileVault. Macs do not hand them out automatically, and they cannot be moved from one account to another. To remove admin rights from that account, first give a secure token to the Factorial IT admin account.
How it works on Windows
The control creates a local admin account and keeps its password. Random or fixed passwords, demoting other admins and taking over an existing account work the same way as on macOS.
Change or switch off the control
You cannot edit the admin username once the control is active. To change it, disable the control and enable it again with the new settings.
Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement. It does not delete the admin account or its password.
Tips and Best Practices
- Use random passwords. One leaked password then opens one device, not all of them.
- Choose the username carefully. It cannot be edited after activation.
- Check SecureTokens before demoting admins on Macs. If the employee's account holds the only SecureToken, give one to the Factorial IT admin account first.
- Add Admin password rotation for accounts that already existed. Without it, Factorial IT cannot show their password.
- Tell employees before demoting their accounts. They lose admin rights, including temporary ones.
Troubleshooting and FAQ
Troubleshooting
- Display password is not available for a device. The account already existed and Factorial IT took it over without knowing its password. Add an Admin password rotation control for the same username.
- An account on a Mac keeps its admin rights after demotion. It is probably the only account with a SecureToken. Give a secure token to the Factorial IT admin account, then try again.
- The admin account is still on the device after you disabled the control. This is expected. Disabling does not delete the account or its password.
FAQ
-
Can I change the admin username later?
Not directly. Disable the control and enable it again with the new username.
-
What happens if the username already exists on the device?
Factorial IT takes over that account instead of creating a new one. Its password stays unknown until you add Admin password rotation.
-
Does demotion remove temporary admin rights?
Yes. Temporary admin rights are demoted too.
-
What is a SecureToken?
A macOS access key needed to switch on FileVault. It is not granted automatically and cannot be transferred.