My friend got a new MacBook Pro from office, later on he resigned and in a hurry erased the "Macintosh HD", now we are trying to install Mojave using Bootable USB but it won't allow because "External Boot" is not allowed, also when we try to access "Startup Security Utility" it shows an error saying no administrator was found, so we can't enable "Allow booting from external media". Somehow online installation from recovery mode is also not working and throws 202 error at the end. Is there any luck?

  • Hey there, Welcome to Apple.SE! I don't have administrator account on my mac is it helpful?
    – anki
    Commented Jul 11, 2019 at 18:52
  • 1
    The system was probably a part of a managed system and needs to be removed from that system. Presumably by their former workplace IT folks. Commented Jul 11, 2019 at 18:54
  • 1
    @ankiiiiiii thanks! but as I mentioned there is no OS on MacBook right now, so how would it boot to "Single User Mode"? Or will it?
    – Hadi
    Commented Jul 11, 2019 at 18:55
  • 2
    @SteveChambers He was given boxed pack MacBook Pro, so he's the first user.
    – Hadi
    Commented Jul 11, 2019 at 18:56
  • Solutions mentioned below do not work for M2 that came with Ventura.
    – Regmi
    Commented Jul 12, 2023 at 5:39

8 Answers 8


I just came into the same situation. But I was lucky enough to workaround it last night. It took me 2 nights searching around to figure out what to do. Here's what you need:

*. A functioning Mac(Better without a T2 chip), mine is the 2014 Mac Mini. Edit: For T2 chip devices, you could temporarily set the security options to allow boot from external devices.(Reboot and then Command + R,not personally tested)

*. An SSD for a fresh install.

*. Create a bootable macOS USB drive.

I will make it short. You could search for tutorials if you don't know what to do for a certain step.

  1. Plug in both SSD and bootable USB drive(with Mojave installer).

  2. Reboot your mac and press Command + R.

  3. Install a fresh Mojave on your SSD, and stop when you see the welcome screen where it asks you to select your country.

  4. Power off and unplug the SSD off your functioning Mac.

  5. Plug your SSD onto your MBP and turn it on.

  6. Press Command + R and enter the recovery mode.

  7. Disk Utilities -> Restore. Here select your SSD and it will copy your SSD's files onto your MBP. And then you can unplug your SSD.

  8. You could try select your internal drive as start up disk but it doesn't let you to. So reboot your MBP. And press Command + R. In my case it failed to boot the macOS and it just reboot into the recovery mode again.

  9. Select Install Mojave. After a couple of minutes, your screen turns black and it reboots.

  10. You will see the lovely Welcome screen again.

  • Great answer! worked like a charm when i thought I was dead in the water cuz i had already erased my Macintosh HD. After step 7 i was able to change my startup disk and it booted up! Thank you
    – ganta
    Commented Dec 30, 2019 at 6:01
  • 1
    Downvoted: As described, External Boot is not allowed, so steps 2+3 don't work. Cmd+R brings up a message that External Boot is not allowed. I'm working through the same problem right now.
    – Drew
    Commented Nov 23, 2020 at 23:18
  • Hi, Drew. You need another functioning Mac(models without T2 chip) or someone to help install a fresh OSX for you(Stop at welcome screen) and start from #6. And then you use the Disk Utilites to clone the whole fresh system to your Mac. It looks like that the T2 security chip blocks external disk boot or installation. Commented Nov 24, 2020 at 1:58
  • Hi. Just trying to work out what the "TL;DR" is on this answer.. Essentially, is it simply installing macOS on a different Mac (without the same boot restrictions) and then swapping the disks?
    – mwfearnley
    Commented Apr 13, 2022 at 9:28
  • Hi, yes. You just need a fresh install before setting up personal information on a disk. So that the T2 chip won't block you again. Commented Apr 13, 2022 at 10:15

I had to boot into recovery mode and reinstall High Sierra (the initial shipped version of macOS). Installing HS gave an administrator account. With the administrator account I was able to allow booting from any external device and finally booted from mac USB stick macOS mojave. After that I could remove HS.

  • 1
    Just did the same thing, in my case the default was Mojave and I installed Monterey from external disk. Had to then re-install Monterey again (so 3 installs in total) from recovery after creating a temp admin account, re-enabling external protection and wiping to remove the temporary admin account. Bonus: reset the NVRAM (option, command, R, P on startup) to give a completely clean startup to the "welcome" screen for the next user. Commented Nov 1, 2021 at 7:48
  • You don't have to install the original. Even if you can't boot from an external drive, you can boot the Internet Recovery system, then plug the drive and run the installer from Terminal.
    – Bachsau
    Commented Nov 2, 2023 at 22:12

I had a similar issue with my 2018 Mini: I had to delete the .AppleSetupDone file and run the "Welcome to Mac" routine, creating a new admin user there before I could alter SecureBoot, even though the disk had been imaged with an admin user.

Peter Thorn's answer here gets to the exact cause of the problem and provides the solution for a working Mac that has MacOS installed.

If you don't have MacOs installed, you could try booting it in Target Mode from another Mac, which I understand bypasses the Secure Boot! (Though if the drive is encrypted, you'll need the password, unless you're wiping it anyway.)

Alternatively, take it to an Apple Store. The SecureBoot settings can't be changed unless there is a valid admin user, so you can't boot to an external. Recovery is another option, but you say that's not working.

PS. I'd love to work somewhere where you get to keep your laptop when you resign!

  • First part doesn't help for wiped systems as in this case (and my case). Target Mode may be worth trying. Darkwonder's response below, which for some reason got the least votes (zero), is the most appropriate. PS When I left my job at a small company after 3 years, I got to keep my laptop..
    – Drew
    Commented Nov 23, 2020 at 23:21
  • This did not work for us — on an M1 Mac with Monterey — it actually broke the Setup Assistant. When it came to the step of "Create a computer account", we got an error "Your computer account could not be created with the name and password specified. Please try again." (Regardless of name & pw.) We had to wipe the boot drive & reinstall.
    – Drew
    Commented Aug 13, 2022 at 2:38

To my experience, it is a question of Secure Tokens, if it doesn't accept the admin even though it has the shipped (old) macOS installed from the recovery partition.

Even though you have created an admin account, you need it to have a Secure Token and update the preboot, for the recovery partition to accept it.

I did the following (when logged in as the local admin account) (both commands run in Terminal):

sysadminctl interactive -secureTokenOn [admin user shortname] -password -

(you will be asked to authenticate).

diskutil apfs updatePreboot /

  • 1
    Yes, this is the best answer. Gets to the nub of the problem and shows the solution.
    – benwiggy
    Commented Jan 7, 2020 at 13:18
  • 1
    It doesn't have the shipped macOS installed - the OP (and me) are trying to install an OS. And there is no created admin account - the boot drive is wiped.
    – Drew
    Commented Nov 23, 2020 at 23:20
  • diskutil: UpdatePreboot: Exiting Update Preboot operation with overall error=(ZeroMeansSuccess)=-69567 Error: -69567: An Open Directory user database record is missing a data field required by EFI Commented Apr 16, 2021 at 22:06
  • To fix error above read this and create "recovery key and do not use icloud": twocanoes.com/… Commented Apr 16, 2021 at 22:09
  • 2
    sysadminctl doesn't exist in the recovery mode.
    – tbeauvais
    Commented Nov 25, 2023 at 19:08

I managed to get around this by using Disk Utility (from recovery mode) to "restore" my internal drive with the image on my external bootable drive. Voila, your bootable drive is no longer "external" and you can boot from it. You'll probably want to create a separate partition on your internal drive for the bootable partition to install to; ideally your second partition is the installer so that you can delete it later without the "you can't remove the first volume on the disk" error.


A friend of mine got one of those corporate-managed MacBooks I think it was Meta so it will always go back to being managed by Meta. Anyhow with the T2 chip and security enabled so cannot boot from external devices. So the MacBook is a brick - re-installing it with any version of MacOS will will make it Meta controlled and she cannot log in as it's linked to Meta corporate accounts. So the only solution was to install Linux on it to make it useful.

This is how I achieved disabling the security:

  1. Start with command + R
  2. At the start up utility go to Utils and select Terminal
  3. Either dd /dev/disk1 or #rm -rf /
  4. Start the Mac and it will go for internet recovery, connect it to your Wi-Fi and let it do its job
  5. It will install Mojave whatever it is called. At the next start, just DO NOT connect it to the internet and just select not connected, the installation will go ahead and it will create a new admin user
  6. Once logged in, don't connect to the internet yet.
  7. Shutdown and restart with command + R
  8. This time you can just go to startup security and enter your password and disable the security and you can now boot from an external USB and install your Linux distro.

ME 1 Meta IT 0


I was able to get to recovery mode by starting to select a start up disk and then quitting with Command - Q. Took me back to recovery mode and I was able to install Mojave on the internal drive.

(I had this exact issue and foolishly wiped the drive not realizing that the security was set to only internal drives.)

William Tong’s answer is great, but similar to commenter, I could still not boot into recovery with the blank Mojave’s SSD. It would prompt that it couldn’t boot from external drive and to choose a startup disk or restart.

  • 1
    Welcome to Ask Different! Please refrain from adding comments in the Answer section, this is for answers to the questions. Once you have sufficient reputation you’ll be able to add comments and ask follow-up questions. To gain reputation, answer questions that are clear and concise. - From Review
    – fsb
    Commented Aug 24, 2021 at 13:29

After referencing this article on Apple: https://discussions.apple.com/thread/8509743 and going through all three of that thread's recommendations:

  1. Enable secure token in Terminal using the command:

    sysadminctl interactive -secureTokenOn <user name> -password <user password>

    This threw the following error:

    2022-10-20 11:00:27.406 sysadminctl[1137:7904] setSecureTokenAuthorizationEnabled error Error Domain=com.apple.OpenDirectory Code=5101 "Authentication server refused operation because the current credentials are not authorized for the requested operation." UserInfo={NSUnderlyingError=0x600000c41350 {Error Domain=com.apple.OpenDirectory Code=5101 "No existing unlock record" UserInfo={NSDescription=No existing unlock record}}, NSLocalizedDescription=Authentication server refused operation because the current credentials are not authorized for the requested operation., NSLocalizedFailureReason=Authentication server refused operation because the current credentials are not authorized for the requested operation.}

  2. Toggle FileVault on and then off again. Filevault would not enable, so the first part of that sequence can’t be completed.

  3. Use the MacOS Setup Assistant to create a new admin account by deleting /var/db/.AppleSetupDone This was the first thing I tried, but the resulting admin account either didn’t generate the token or could not set it to On as it should have.

After all three of those failed, since I didn't need anything on the MBP's internal SSD, just get it deployable, I booted into Recovery, deleted the Boot volume, created a new Boot volume, and installed Monterrey into the new APFS volume. This apparently corrected whatever was at fault in BridgeOS, as the 501 admin account was recognized by the Startup Security Utility as an admin, and FileVault could be enabled normally.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .