"No administrator was found" in Startup Security Utility

Question

My friend got a new MacBook Pro from office, later on he resigned and in a hurry erased the "Macintosh HD", now we are trying to install Mojave using Bootable USB but it won't allow because "External Boot" is not allowed, also when we try to access "Startup Security Utility" it shows an error saying no administrator was found, so we can't enable "Allow booting from external media". Somehow online installation from recovery mode is also not working and throws 202 error at the end. Is there any luck?

Answer 1

I just came into the same situation. But I was lucky enough to workaround it last night. It took me 2 nights searching around to figure out what to do. Here's what you need:

*. A functioning Mac(Better without a T2 chip), mine is the 2014 Mac Mini. Edit: For T2 chip devices, you could temporarily set the security options to allow boot from external devices.(Reboot and then Command + R,not personally tested)

*. An SSD for a fresh install.

*. Create a bootable macOS USB drive.

I will make it short. You could search for tutorials if you don't know what to do for a certain step.

1. Plug in both SSD and bootable USB drive(with Mojave installer).

2. Reboot your mac and press Command + R.

3. Install a fresh Mojave on your SSD, and stop when you see the welcome screen where it asks you to select your country.

4. Power off and unplug the SSD off your functioning Mac.

5. Plug your SSD onto your MBP and turn it on.

6. Press Command + R and enter the recovery mode.

7. Disk Utilities -> Restore. Here select your SSD and it will copy your SSD's files onto your MBP. And then you can unplug your SSD.

8. You could try select your internal drive as start up disk but it doesn't let you to. So reboot your MBP. And press Command + R. In my case it failed to boot the macOS and it just reboot into the recovery mode again.

9. Select Install Mojave. After a couple of minutes, your screen turns black and it reboots.

10. You will see the lovely Welcome screen again.

Answer 2

I had to boot into recovery mode and reinstall High Sierra (the initial shipped version of macOS). Installing HS gave an administrator account. With the administrator account I was able to allow booting from any external device and finally booted from mac USB stick macOS mojave. After that I could remove HS.

Answer 3

I had a similar issue with my 2018 Mini: I had to delete the .AppleSetupDone file and run the "Welcome to Mac" routine, creating a new admin user there before I could alter SecureBoot, even though the disk had been imaged with an admin user.

Peter Thorn's answer here gets to the exact cause of the problem and provides the solution for a working Mac that has MacOS installed.

If you don't have MacOs installed, you could try booting it in Target Mode from another Mac, which I understand bypasses the Secure Boot! (Though if the drive is encrypted, you'll need the password, unless you're wiping it anyway.)

Alternatively, take it to an Apple Store. The SecureBoot settings can't be changed unless there is a valid admin user, so you can't boot to an external. Recovery is another option, but you say that's not working.

PS. I'd love to work somewhere where you get to keep your laptop when you resign!

Answer 4

To my experience, it is a question of Secure Tokens, if it doesn't accept the admin even though it has the shipped (old) macOS installed from the recovery partition.

Even though you have created an admin account, you need it to have a Secure Token and update the preboot, for the recovery partition to accept it.

I did the following (when logged in as the local admin account) (both commands run in Terminal):

sysadminctl interactive -secureTokenOn [admin user shortname] -password -

(you will be asked to authenticate).

diskutil apfs updatePreboot /

Answer 5

I managed to get around this by using Disk Utility (from recovery mode) to "restore" my internal drive with the image on my external bootable drive. Voila, your bootable drive is no longer "external" and you can boot from it. You'll probably want to create a separate partition on your internal drive for the bootable partition to install to; ideally your second partition is the installer so that you can delete it later without the "you can't remove the first volume on the disk" error.

Answer 6

A friend of mine got one of those corporate-managed MacBooks I think it was Meta so it will always go back to being managed by Meta. Anyhow with the T2 chip and security enabled so cannot boot from external devices. So the MacBook is a brick - re-installing it with any version of MacOS will will make it Meta controlled and she cannot log in as it's linked to Meta corporate accounts. So the only solution was to install Linux on it to make it useful.

This is how I achieved disabling the security:

1. Start with command + R
2. At the start up utility go to Utils and select Terminal
3. Either dd /dev/disk1 or #rm -rf /
4. Start the Mac and it will go for internet recovery, connect it to your Wi-Fi and let it do its job
5. It will install Mojave whatever it is called. At the next start, just DO NOT connect it to the internet and just select not connected, the installation will go ahead and it will create a new admin user
6. Once logged in, don't connect to the internet yet.
7. Shutdown and restart with command + R
8. This time you can just go to startup security and enter your password and disable the security and you can now boot from an external USB and install your Linux distro.

ME 1 Meta IT 0

Answer 7

I was able to get to recovery mode by starting to select a start up disk and then quitting with Command - Q. Took me back to recovery mode and I was able to install Mojave on the internal drive.

(I had this exact issue and foolishly wiped the drive not realizing that the security was set to only internal drives.)

William Tong’s answer is great, but similar to commenter, I could still not boot into recovery with the blank Mojave’s SSD. It would prompt that it couldn’t boot from external drive and to choose a startup disk or restart.

Answer 8

After referencing this article on Apple: https://discussions.apple.com/thread/8509743 and going through all three of that thread's recommendations:

1. Enable secure token in Terminal using the command:

   sysadminctl interactive -secureTokenOn <user name> -password <user password>

   This threw the following error:

   2022-10-20 11:00:27.406 sysadminctl[1137:7904] setSecureTokenAuthorizationEnabled error Error Domain=com.apple.OpenDirectory Code=5101 "Authentication server refused operation because the current credentials are not authorized for the requested operation." UserInfo={NSUnderlyingError=0x600000c41350 {Error Domain=com.apple.OpenDirectory Code=5101 "No existing unlock record" UserInfo={NSDescription=No existing unlock record}}, NSLocalizedDescription=Authentication server refused operation because the current credentials are not authorized for the requested operation., NSLocalizedFailureReason=Authentication server refused operation because the current credentials are not authorized for the requested operation.}

2. Toggle FileVault on and then off again. Filevault would not enable, so the first part of that sequence can’t be completed.

3. Use the MacOS Setup Assistant to create a new admin account by deleting /var/db/.AppleSetupDone This was the first thing I tried, but the resulting admin account either didn’t generate the token or could not set it to On as it should have.

After all three of those failed, since I didn't need anything on the MBP's internal SSD, just get it deployable, I booted into Recovery, deleted the Boot volume, created a new Boot volume, and installed Monterrey into the new APFS volume. This apparently corrected whatever was at fault in BridgeOS, as the 501 admin account was recognized by the Startup Security Utility as an admin, and FileVault could be enabled normally.