What is a Secure Token and how do I get an admin users that has one

Question

I have an iMac 2017 with a FusionDrive on which FileVault cannot not be enabled. The situation is summed up in this reddit post. The problem boils down to: I have no admin user who has a secure token and it seems like I cannot get one. This can be confirmed by running:

sysadminctl interactive -secureTokenStatus USER_NAME

for every user. It always comes back with

Secure token is DISABLED for user USER_NAME

The first setup from factory settings did not result in a user with a Secure Token, and I tried to:

• Delete /var/db/.AppleSetupDone to setup a new admin account. Result: A new admin account that slo does not have a token.
• Reinstall MacOS High Sierra: First created admin user does not have secure token.

It seems that this is either intentional (because of the Fusion Drive?) or a bug in High Sierra. With exactly the same procedure on a Macbook Pro 2017 I get an admin user with a Secure Token and that user can manage FileVault and give secure tokens to other users.

Since I want to use FileVault, I also tried to reformat the main disk with an encrypted file system, reinstalling MacOS and restoring from time machine backup. This worked, FileVault is enabled, but now I have to enter the disk password every time the computer boots (before the login screen). I don't want this, I want to unlock the disk with a user password.

What can I do to get an admin user with a secure token?

Answer 1

Just migrated to a new 2018 MacBook Pro, and somehow my original account (an admin user) was created without a secure token during the migration. I even tried creating a new admin user, logging into that user and trying to run sysadminctl -secureTokenOn justin -password - but getting:

2018-07-30 14:17:56.552 sysadminctl[886:18232] Operation is not permitted without secure token unlock.

So then I tried the following providing adminUser and adminPassword flags as my original user justin:

sysadminctl -secureTokenOn justin -password - -adminUser justin -adminPassword -

Enter password for justin :

Enter password for Justin K :

2018-07-30 14:31:05.262 sysadminctl[998:49031] setSecureTokenAuthorizationEnabled error Error Domain=com.apple.OpenDirectory Code=5101 "Authentication server refused operation because the current credentials are not authorized for the requested operation." UserInfo={NSLocalizedDescription=Authentication server refused operation because the current credentials are not authorized for the requested operation., NSLocalizedFailureReason=Authentication server refused operation because the current credentials are not authorized for the requested operation.}

Essentially it seems since non of my users have a secure token, there is no way to grant a secure token. The only downfall is the following:

• When I cold start the machine I have to enter a disk decryption password, which results in entering my password twice (once for disk decryption and once for the user account).

• When I try to turn off FileVault by clicking the button nothing happens. The same behavior when clicking the warning button "Some users are not able to unlock the disk [Enable Users...]" nothing happens.

Answer 2

I found myself in this situation. I think this was because I did a clean OS install while FileVault was enabled, so the users weren't migrated.

Accordingly, System Preferences complained "Some users are not able to unlock the disk" but clicking "Enable Users" did nothing, sysadminctl -secureTokenStatus jrc (my main user) said "DISABLED", and sysadminctl -secureTokenOn ... was useless.

A clue came from the fact that fdesetup list -extended reported a "Unknown User" entry. So I solved the problem by creating a new user, changing the UUID of that user to that of the unknown user, and using that new user to fix up my existing user. This required a trip to recovery mode (or single user mode) as the Directory Services store is protected by System Integrity Protection (SIP).

1. Note the UUID of the unknown user(s) reported from sudo fdesetup list -extended.
2. In System Preferences > Users & Groups, create a new administrator user (named admin in this example) using the same password as your main user account.
3. Boot into Recovery Mode and changing the GeneratedUID of the newly created user to match the above UUID. This can be done by opening Utilities menu > Terminal in Recovery Mode, then running dscl -f "/Volumes/Macintosh HD/var/db/dslocal/nodes/Default" localonly -changei /Local/Default/Users/admin GeneratedUID 1 5BBB4CE0-FEC9-4922-A456-5FE00534C065. Substitute your volume name, username, and UUID as appropriate. Everything is case-sensitive.
4. Reboot normally. sysadminctl -secureTokenStatus admin should now report "ENABLED". (Yay!)
5. sudo fdesetup add -usertoadd jrc. When prompted, enter the credentials of the above admin user.
6. Finally, run diskutil apfs updatePreboot / to fix up the boot graphics.

Some related links that I found helpful:

• https://carpeaqua.com/2017/11/30/updating-your-apfs-encrypted-volume-filevault-password/
• https://derflounder.wordpress.com/2019/02/10/re-syncing-local-account-passwords-and-secure-token-on-filevault-encrypted-macs-running-macos-mojave/

Answer 3

It does seem you've come across a bug, since you should be granted a secure token when…

1. Secure Token is automatically enabled for the user account created by Apple’s Setup Assistant.
2. The Setup Assistant-created user account with Secure Token then creates other users via the Users & Groups preference pane in System Preferences. Those accounts get their own Secure Token automatically.

Secure Token and FileVault on Apple File System - Der Flounder

To manually grant a secure token, run

sysadminctl -secureTokenOn yourusername -password -

where yourusername is the username of the user you wish to grant a secure token to. Don't forget the hyphen at the end too! Don't use sudo.

You'll first be prompted to ‘unlock’ Users & Groups preferences by providing administrator credentials to the GUI dialog, then you'll be prompted for the password to the account you wish to give a token to on the CLI.

Answer 4

I was able to make this work. First, diagnoze that you have the same issue. Run:

sysadminctl -secureTokenStatus <username>

If it shows "secure token disabled," and you have no other users on the system that have it enabled, you need to go through this dance.

Force the Apple Setup wizard to run on your next install by running:

sudo rm /var/db/.AppleSetupDone

And restart your computer. After the restart finishes, log in as this new admin and create a new admin user; with that user, go to Settings | Security & Privacy | File Vault, and grant your actual user the privileges to unlock the file system. Run this again, it should now say enabled for your actual user:

sysadminctl -secureTokenStatus <username>

Answer 5

I have the same issue and removing the AppleSetupDone file and rebooting to force the creation of a new admin account doesn't give the new account a token. The only thing that has worked has been backing up the user profile, flattening the machine and doing a new High Sierra install from a bootable USB, not exactly ideal when I've got loads of Macs to upgrade to the 10.13.

Answer 6

In this answer I will outline my resolution of the situation:

1. I contacted AppleCare and together we tried various things like reinstalling MacOS High Sierra and trying to enable FileVault before the migration of any user data. This is not successful.
2. The Internet Recovery on this Mac installs MacOS Sierra and in MacOS Sierra FileVault can be enabled. (This clearly indicates a software issue) One can then update to High Sierra and use Migration assistant to get the user data back. The problem is that in this situation only the users that were created in Sierra can unlock the disk, not any users migrated or created after the migration.
3. AppleCare tried to reproduced my issue on a similar iMac with Fusion Drive and they could not. They offered to look at it in person, but the next store is quite a drive away, so I did not go for this option.
4. Since rebooting the computer does not happen so often, I settled for myself with the solution to install High Sierra inside a volume that is encrypted from the start. This works, but leads to the situation where you have to enter the decryption password every time the computer boots.
5. After installing the latest Supplemental Update, the boot loader was probably rewritten or something, I'm now in a situation where after first boot a screen appears in which both users can log in, or I can unlock the disk. It looks like this: On this screen both users can log in and thereby unlock the disk. The third option is to unlock the disk upon which another login screen with only the two users is presented.

That means the problem is basically solved, except that there is this strange login item, but well...

I also confirmed with Apple Support that the Secure Token situation described in the question is most likely irrelevant because Secure Tokens pertain to APFS and this is a Mac with a Fusion Drive.