Page History

Apple requires administrative accounts to have a secure token to perform several administrative tasks such as resetting a local account password or interacting with FileVault disk encryption. USask managed Mac endpoints have an administrator account that is used by IT Support Services as required, but also may be delegated to faculty or staff to perform administrative tasks.

No, this will not remove administrator access from accounts that currently have it. You are seeing the prompt as we require an existing account with a secure token to add a secure token to the administrator account.

You will be prompted again if we require a your password to enable a secure token on the administrator account.

Yes, you can create a temporary account in System Preferences. The policy will look for this account, and if it exists and has a secure token, it will use it instead of prompting.

Username: tempuser

Password: temppa55

Once you've created the account, restart your device. The account will be deleted automatically after the secure token is enabled which should be within an hour.

Once the password has been entered successfully you should see the following for the object in Jamf (Inventory\General):

Administrator Password (LAPS): Randomly-Generated-Password

Secure Token (LAPS): Enabled