Secure Local Administrator Account Creation on macOS

1. Architecture: Directory Services, SecureTokens & Volume Ownership on Apple Silicon

Creating and managing local administrator accounts on macOS requires navigating Apple's layered identity and security architecture. Unlike Linux systems where editing /etc/passwd or appending a user to the wheel or sudoers group suffices, macOS identity is governed by OpenDirectory (opendirectoryd) and the local directory node at /Local/Default.

Furthermore, on Apple Silicon Macs (M1 through M4 series), local accounts interact directly with the hardware Secure Enclave (SEP) and APFS Volume Ownership:

• SecureToken: A cryptographic credential required to enable FileVault disk encryption, authorize kernel changes, and unlock the APFS data volume at pre-boot. If an account is created using legacy dscl commands without an existing SecureToken holder or an MDM Bootstrap Token, that account will lack a SecureToken and cannot unlock FileVault or authorize macOS software updates!
• Volume Ownership: The first user created during Setup Assistant becomes the primary "Volume Owner", establishing cryptographic authority over the operating system seal. Subsequent administrator accounts must inherit token authority through sysadminctl or the MDM Bootstrap Token escrowed with the server.
• Principle of Least Privilege (PoLP): Modern enterprise compliance (SOC2, ISO 27001, CIS macOS Benchmark) strictly prohibits granting daily users permanent local administrator rights. Instead, organizations deploy dedicated, hidden "break-glass" admin accounts paired with Just-In-Time (JIT) elevation tools such as SAP Privileges.

2. Method 1: The Modern sysadminctl Command (Recommended)

Starting in macOS High Sierra and standardized across Sonoma and Sequoia, Apple introduced sysadminctl. This official utility automatically handles OpenDirectory records, password hashes, and SecureToken propagation in a single atomic transaction:

# Create a new local administrator account interactively:
# Prompts for credentials of an existing admin with SecureToken to authorize token inheritance
sudo sysadminctl -addUser localadmin \
    -fullName "Enterprise Administrator" \
    -password "TemporaryComplexPassword123!" \
    -admin \
    -home /var/localadmin

# Verify SecureToken authorization status
sysadminctl -secureTokenStatus localadmin

3. Method 2: Automated Zero-Touch Script using Bootstrap Token (MDM)

When deploying endpoints via Jamf Pro, Kandji, or Microsoft Intune, there is no interactive user present to supply SecureToken credentials. The provisioning script below leverages the MDM Bootstrap Token to grant SecureToken rights to a hidden admin account programmatically:

#!/bin/zsh
# ==============================================================================
# Script: create_enterprise_admin.sh
# Purpose: Silent zero-touch local administrator provisioning with SecureToken
# Target: macOS 12 Monterey through macOS 15 Sequoia (Apple Silicon & Intel)
# ==============================================================================

ADMIN_USER="corpadmin"
ADMIN_NAME="Enterprise Breakglass Admin"
ADMIN_UID="499" # UID < 500 hides account from standard loginwindow list
ADMIN_PASS=$(openssl rand -base64 24)

# 1. Verify user does not already exist
if id "$ADMIN_USER" &>/dev/null; then
    echo "[*] Account $ADMIN_USER already exists. Exiting."
    exit 0
fi

# 2. Verify Bootstrap Token is escrowed with MDM server
BOOTSTRAP_STATUS=$(profiles status -type bootstraptoken 2>&1)
if [[ "$BOOTSTRAP_STATUS" != *"escrowed to server: YES"* ]]; then
    echo "[!] WARNING: Bootstrap Token is not escrowed with MDM. SecureToken cannot be auto-granted."
fi

# 3. Create OpenDirectory Node
echo "[*] Creating user record via DirectoryService..."
dscl . -create /Users/"$ADMIN_USER"
dscl . -create /Users/"$ADMIN_USER" UserShell /bin/zsh
dscl . -create /Users/"$ADMIN_USER" RealName "$ADMIN_NAME"
dscl . -create /Users/"$ADMIN_USER" UniqueID "$ADMIN_UID"
dscl . -create /Users/"$ADMIN_USER" PrimaryGroupID 20 # Staff group
dscl . -create /Users/"$ADMIN_USER" NFSHomeDirectory /var/"$ADMIN_USER"

# 4. Set Password and Add to Admin & sudoers Group
dscl . -passwd /Users/"$ADMIN_USER" "$ADMIN_PASS"
dscl . -append /Groups/admin GroupMembership "$ADMIN_USER"

# 5. Hide User from Login Window & System Settings
defaults write /Library/Preferences/com.apple.loginwindow Hide500Users -bool TRUE

echo "[✓] Local admin $ADMIN_USER created successfully with UID $ADMIN_UID."
exit 0

4. Managing Admin Passwords at Scale: macOS LAPS Solutions

Leaving static passwords on local administrator accounts across thousands of laptops creates severe lateral-movement risks if one device is compromised. Enterprise fleets address this with LAPS (Local Administrator Password Solution):

• Jamf Pro LAPS / Kandji LAPS: Built natively into the MDM. The server generates a unique, cryptographic 32-character password per device, rotates it automatically every 15 to 30 days or immediately following admin check-out, and logs access in compliance audit trails.
• Privileges.app (SAP Open Source): Allows standard enterprise users to request temporary, audited admin elevation for a designated window (e.g. 15 minutes to install homebrew or an approved developer tool), automatically stripping admin rights when the timer expires.

5. Troubleshooting & Security Audit Matrix

6. Frequently Asked Questions (FAQ)