How to Use the sysadminctl Command in macOS Terminal to Manage Secure Tokens and User Accounts

In Apple macOS, user account management is intimately coupled with filesystem-level encryption and hardware-backed cryptographic security. Following the transition to the Apple File System (APFS) and the introduction of Apple Silicon (M1 through M4 chips), simply creating a user account record in Open Directory using traditional Unix tools or legacy dscl scripts is no longer sufficient. To participate in full-disk encryption, unlock a FileVault-protected Mac at the preboot login screen, and authorise macOS software updates, a user account must possess a cryptographic attribute known as a Secure Token.

When system administrators or deployment scripts create local user accounts via legacy command-line utilities without establishing a cryptographic Secure Token chain, those accounts become “orphaned”—they cannot unlock FileVault, cannot change their own passwords securely, and are invisible at preboot. To bridge this architectural gap from the command line, Apple introduced the sysadminctl administrative binary. Unlike dscl, sysadminctl coordinates directly with the macOS LocalAuthentication and CryptoTokenKit daemons, ensuring that accounts are provisioned with valid Secure Tokens and Volume Ownership. This comprehensive guide outlines the mechanics of Secure Tokens, demonstrates the command syntax for sysadminctl, and explains how to audit and repair token delegation.

Secure Tokens and Volume Ownership: Architectural Comparison

Understanding how macOS evaluates user privileges reveals why traditional directory tools fail in modern APFS environments:

Tool / Management Layer	Creates Open Directory Record	Grants Secure Token	Grants APFS Volume Ownership	FileVault Preboot Unlock
sysadminctl	Yes	Yes (when authorized by existing token holder)	Yes	Yes
Legacy dscl	Yes	No (cryptographic token omitted)	No	No (account cannot unlock Mac at boot)
MDM Bootstrap Token	N/A (Enterprise Escrow)	Yes (kernel escrows token to MDM server)	Yes	Yes (enables automated token granting)
System Settings GUI	Yes	Yes (via graphical authentication prompt)	Yes	Yes

Auditing Secure Token Status for Local Accounts

Before modifying accounts, verify whether an active user holds a Secure Token. Open Terminal (located in /Applications/Utilities/Terminal.app) and execute:

sysadminctl -secureTokenStatus <username>

For example, to inspect the user jdoe:

sysadminctl -secureTokenStatus jdoe

Terminal will return one of two definitive statuses:

• 2026-10-23 08:30:15.120 sysadminctl[...] Secure token is ENABLED for user jdoe
• 2026-10-23 08:30:15.120 sysadminctl[...] Secure token is DISABLED for user jdoe

Note: On any freshly provisioned Mac, the very first user account created during the Setup Assistant automatically receives Secure Token #1. Any subsequent user accounts can only receive a Secure Token if an existing token holder provides their credentials to authorise the cryptographic delegation chain.

Creating a New User Account with a Secure Token via sysadminctl

To provision a new standard or administrative account that correctly receives a Secure Token upon creation, you must provide the credentials of an existing administrator who already holds a Secure Token:

sudo sysadminctl -addUser newuser \
  -fullName "Jane Doe" \
  -password "InitialSecurePass123!" \
  -adminUser existingadmin \
  -adminPassword "AdminPassword456!"

In this command:

• -addUser newuser: Defines the short Unix account name.
• -fullName "Jane Doe": Assigns the human-readable display name.
• -password "...": Sets the initial login password for the new account.
• -adminUser ... and -adminPassword ...: Supplies the active Secure Token holder’s authentication, immediately forging a cryptographic token for newuser.

Creating an Administrator Account Directly

To grant full administrative privileges to the new user account, append the -admin flag:

sudo sysadminctl -addUser backupadmin \
  -fullName "Backup Administrator" \
  -password "EnterprisePass789!" \
  -admin \
  -adminUser existingadmin \
  -adminPassword "AdminPassword456!"

Enabling a Secure Token on an Existing Account

If an account was previously created via automated deployment scripts or remote management tools without a Secure Token, you can retroactively enable token privileges:

sudo sysadminctl -secureTokenOn targetuser \
  -password "TargetUserPassword" \
  -adminUser tokenholder \
  -adminPassword "TokenHolderPassword"

Both passwords must be supplied simultaneously. The tokenholder authorises the cryptographic handover, while the targetuser password is used by the system to wrap their unique APFS volume decryption key.

Revoking Secure Tokens and Deleting Accounts Safely

To remove Secure Token privileges from an account without deleting the user’s home folder files:

sudo sysadminctl -secureTokenOff targetuser \
  -password "TargetUserPassword" \
  -adminUser tokenholder \
  -adminPassword "TokenHolderPassword"

When offboarding an employee, delete their user account cleanly from Open Directory and purge their cryptographic volume entitlements:

sudo sysadminctl -deleteUser targetuser -secure -adminUser existingadmin -adminPassword "AdminPassword456!"

The -secure flag instructs macOS to securely wipe the user’s credentials and revoke their encryption keys from the APFS cryptographic metadata partition.

Enterprise Integration: The MDM Bootstrap Token

In managed enterprise environments running Microsoft Intune, Jamf Pro, or Kandji, requiring a human administrator to type credentials for every local account is impractical. Modern macOS supports the Bootstrap Token mechanism:

1. During initial device enrolment, macOS generates a cryptographic Bootstrap Token and escrows it with the Mobile Device Management (MDM) server.
2. When a standard user logs into the Mac for the first time via corporate SSO, the kernel requests the Bootstrap Token from the MDM server.
3. macOS uses the escrowed Bootstrap Token to automatically grant the user a Secure Token and Volume Ownership without requiring manual admin intervention.

To verify that your Mac has escrowed a Bootstrap Token with your MDM server:

sudo profiles status -type bootstraptoken

The output should confirm: Bootstrap token supported on server: YES and Bootstrap token escrowed to server: YES.

By utilising sysadminctl for account provisioning and Secure Token delegation, macOS administrators ensure uninterrupted FileVault operation, prevent login deadlocks, and maintain enterprise cryptographic compliance.