Platform compatibility
Before you begin
- On macOS, the device needs another admin account with a SecureToken whose password is stored in Primo. macOS only lets a SecureToken admin change another account’s password. The account created by Admin management receives its token at its first login. See SecureToken rules.
- Check the Password requirements you pick against your password policy. A generated password that breaks the policy is refused by the device.
Set up the control
1
Go to MDM > Controls > Add new control
Select Admin password rotation.
2
Enter the admin username
In Rotate passwords for all accounts matching, enter the username of the local administrator account to rotate, for example
admin-primo. The match is not case-sensitive.3
Set the rotation frequency
Choose Every month, Every 2 months, Every 3 months, or Every 6 months.
4
Set the password requirements
Choose how strong the generated password is:
5
Select targeting
Choose which devices to apply the control to: all devices, specific device groups, or a custom target.
How it works
Primo rotates the password of every local administrator account on the device whose username matches the control. Standard accounts and accounts that are not local are skipped.- First rotation: Primo counts the rotation interval from the account’s creation date or its last password change. When the interval has passed, Primo generates a new password, applies it on the device, and stores it encrypted in the cockpit.
- Accounts Primo did not create: if the account already existed on the device, Primo doesn’t know its password. Primo replaces the password at the next sync, then follows the rotation frequency. The current password of that account is overwritten.
- Several controls on one device: when more than one rotation control targets the same device, the shortest frequency and the strongest password requirements apply.