What is the Secure Token?
The Secure Token is a security identifier generated by macOS and linked to a local user account. It enables data encryption and decryption through FileVault. A user with a Secure Token is considered “authorized” to perform sensitive system actions such as:- Enabling or disabling FileVault
- Changing another local user’s password (if the user has a Secure Token)
- Creating a new local user
- Granting a Secure Token to another account
Why the Secure Token matters for Primo
Primo relies on the Secure Token to securely manage macOS users. When resetting a password or creating a new user through Primo, macOS requires that the action be initiated by an account that holds a Secure Token. This ensures:- Compliance with Apple’s security requirements
- Continued access to the FileVault-encrypted disk
- Proper execution of user management actions via Primo
Check the Secure Token status in Primo
The Secure Token status is displayed directly in the Primo cockpit, under the Users tab of the relevant device. You can quickly verify whether the macOS administrator account used by Primo holds an active Secure Token.To ensure proper user management via Primo, make sure the administrator account linked to the device has a Secure Token.
Transfer Secure Token
If you have an account that has a SecureToken granted and you want another account to have it, follow this procedure:- If needed, Promote the account with SecureToken Granted (must be sudoers)
- Run
sudo sysadminctl -secureTokenOn seconduseraccount -password - -adminUser firstuseraccount -adminPassword - - To check if the secureToken is enabled on the new account, run
sudo sysadminctl -secureTokenStatus seconduseraccount - If needed, Demote the account.