Any way to access Startup Security Utility when Internal SSD dead/corrupt?

Question

We have a 2018 MBP business laptop with an SSD that's died. The support company have declared it is dead and recommended recycling it. I'd very much like to get it booting from an external SSH. FYI: The machine does NOT allow booting from external drives, but doesn't have a firmware password set.

Things I've tried:

1. When I attempt to access Startup Security Utility with no external SSD attached, I get the no admin accounts exist message.

2. I've entered Recovery Mode with a known-good OS on an external SSD, and can access Startup Security Utility, and can select one of the Admin accounts on that external SSD OS, but entering the passwords for these accounts does nothing.

3. As a punt, I also tried to enter the admin account pass for the dead Mac, even though the selectable username was wrong, but no dice.

4. In an attempt to be hacky about it, I booted from the external SSD on a different MBP, and added an admin account with the same username and password that I know was on the dead Mac, then attempted No. 2 again, and this time I can select the correct username, but entering the correct password fails. So I'm assuming there's more than just a user/password combo stored in the T2 (or wherever).

Any other ideas? Is there any hope of getting this thing usable even for my kid?

Cheers!

Answer 1

The T2 chip holds a signed certificate and secure token linked to the admin account that can authenticate the Recovery Utilities. So another account with the same name and password won't cut it.

You could try to add a SecureToken for a user account on the external disk, using the sysadminctl command. (If that works in Recovery.)

sysadminctl interactive -secureTokenOn [admin user shortname] -password -

(you will be asked to authenticate). Then this:

diskutil apfs updatePreboot /

But if it needs to store the token on the internal SSD, then ....