Platform compatibility
Set up the control
1
Go to MDM > Controls > Add new control
Select Admin management.
2
Define the admin username
Enter the username of the administrator account to create.
3
Set the account password
- Random password — generated per device (recommended)
- Fixed password — identical across all targeted devices
4
Optionally demote other admin accounts
Enable Automatically demote non-compliant admin accounts to automatically reduce other accounts to standard access. Temporary admin rights granted by the Helpdesk Agent are demoted too.
5
Select targeting
Choose which devices to apply the control to: all devices, specific device groups, or a custom target.
How it works
- macOS
- Windows
The control creates a local administrator account and stores the password in the cockpit.Account that already exists — if an account with the same username already exists on the device and Primo did not create it, Primo adopts it instead of creating a new one. The control reports it as created, but Primo doesn’t know its password, so Display password isn’t available for it. To have Primo set and store its password, add an Admin password rotation control for the same username.Removing administrator access — it is not currently possible to remove administrator rights from an account if it is the only one with a SecureToken on the device. SecureToken is a macOS-specific access key required to activate FileVault encryption. Secure tokens aren’t granted automatically and can’t be transferred. To remove administrator rights from that account, first grant a secure token to the Primo admin account.