How to change user from "Staff" to Standard or Managed?

[sparkie7]

If not, I suppose you could manually add your primary user account with this (might have to use this with sudo):
sysadminctl -secureTokenOn <username> -password - interactive (note the whitespace between the dash and “interactive”)

you mean:

sudo sysadminctl -secureTokenOn <username> -password - -interactive

Update, I tried that command and got this:

2022-03-19 23:38:17.259 sysadminctl[7050:120302] Operation is not permitted without secure token unlock.

 

[KALLT]

No, it doesn't

How do you log into your Mac at all when you start the computer? Are you not using the primary user account?

I have only seen this when macOS is installed on an already encrypted file system. In that case, FileVault won’t be configured properly, unlike when you enable it after installation manually in System Preferences.

you mean:

sudo sysadminctl -secureTokenOn <username> -password - -interactive

The help you posted says this:

-secureTokenOn <user name> -password <password> (interactive || -adminUser <administrator user name> -adminPassword <administrator password>)
...
Pass '-' instead of password in commands above to request prompt.

I am presuming that you use - as a substitute for your password, so that you are prompted. The keyword interactive (without a dash) is a substitute for the admin user and admin password arguments.

 

[sparkie7]

How do you log into your Mac at all when you start the computer? Are you not using the primary user account?

Yes, I'm using the primary account . It says Admin under that user account

I have only seen this when macOS is installed on an already encrypted file system. In that case, FileVault won’t be configured properly, unlike when you enable it after installation manually in System Preferences.

I think my drive is encrypted. I formatted it using encryption

The help you posted says this:


I am presuming that you use - as a substitute for your password, so that you are prompted. The keyword interactive (without a dash) is a substitute for the admin user and admin password arguments.

Sorry you lost me

 

[KALLT]

you mean:

sudo sysadminctl -secureTokenOn <username> -password - -interactive

Update, I tried that command and got this:

2022-03-19 23:38:17.259 sysadminctl[7050:120302] Operation is not permitted without secure token unlock.

Just to clarify: which account credentials did you use as “admin”? As I understand it, you have to supply both account credentials to make this work. So you enter sysadminctl -secureTokenOn <primary user> -password - interactive and then it should ask you for that user’s password and then ask for the admin user and admin password, in which case you would enter the credentials of the other user, the one that you want to delete.

 

[TriciaMacMillan]

I do have an Admin user. The one I'm trying to delete is not designated as Admin

Then it might be the case that you have only one user that is authorized to unlock FileVault. Did you check that?

 

[sparkie7]

So you enter sysadminctl -secureTokenOn <primary user> -password - interactive

I tried that, where <primary user> is John, confused about the rest of "-password - interactive[/icode]". What do I type there, the password for user John?

Sorry if I'm not getting it

 

[Mr. Awesome]

I tried that, where <primary user> is John, confused about the rest of "-password - interactive[/icode]". What do I type there, the password for user John?

Sorry if I'm not getting it

Just leave the rest of it as is (but I think you need to make sure the hyphen and “interactive” don’t have a space between them.)

 

[sparkie7]

Then it might be the case that you have only one user that is authorized to unlock FileVault. Did you check that?

I have gone into FileVault and 'enabled users' to Unlock this Disk

 

[sparkie7]

Just leave the rest of it as is (but I think you need to make sure the hyphen and “interactive” don’t have a space between them.)

Got this back in Terminal:

2022-03-20 00:15:07.590 sysadminctl[8536:146187] Operation is not permitted without secure token unlock.

 

[Mr. Awesome]

Got this back in Terminal:

2022-03-20 00:15:07.590 sysadminctl[8536:146187] Operation is not permitted without secure token unlock.

I have an idea. Log into the account that does have a secure token (yodel, I think? Could be remembering that wrong), and try to give your account (John) a secure token from there using that same command.

 

[KALLT]

I have done a bit of digging on the web and perhaps the command was not used correctly.

Try it like this without sudo:
sysadminctl -secureTokenOn John -password -

then enter the credentials of the other account. You should also try it while being logged into the other account, perhaps that makes a difference here. The key thing is that the other account holds the secure token and it is needed for this to work.

Otherwise it seems that there is some deeper issue that needs more specific solutions.

Further reading:

Secure Token and FileVault on Apple File System

As part of Apple File System’s FileVault encryption on mac OS High Sierra, Apple introduced Secure Token. This is a new and undocumented account attribute, which is now required to be added t…

derflounder.wordpress.com

What is a Secure Token and how do I get an admin users that has one

I have an iMac 2017 with a FusionDrive on which FileVault cannot not be enabled. The situation is summed up in this reddit post. The problem boils down to: I have no admin user who has a secure t...

apple.stackexchange.com

 

[sparkie7]

I have done a bit of digging on the web and perhaps the command was not used correctly.

Try it like this without sudo:
sysadminctl -secureTokenOn John -password -

Do I need to enter my actual password for John user? or just leave it as "-password -" ?

 

[sparkie7]

I have an idea. Log into the account that does have a secure token (yodel, I think? Could be remembering that wrong), and try to give your account (John) a secure token from there using that same command.

What's the exact command I should be using?

 

[sparkie7]

I have done a bit of digging on the web and perhaps the command was not used correctly.

Try it like this without sudo:
sysadminctl -secureTokenOn John -password -

then enter the credentials of the other account. You should also try it while being logged into the other account, perhaps that makes a difference here. The key thing is that the other account holds the secure token and it is needed for this to work.

It's giving me the same:

2022-03-20 00:48:02.919 sysadminctl[10741:179733] Operation is not permitted without secure token unlock.


It's letting me enter the credentials of the other account Todel (that I want to delete)

I'll try logging out and log into Todel and try from there

 

[sparkie7]

Further reading:

Secure Token and FileVault on Apple File System

As part of Apple File System’s FileVault encryption on mac OS High Sierra, Apple introduced Secure Token. This is a new and undocumented account attribute, which is now required to be added t…

derflounder.wordpress.com

What is a Secure Token and how do I get an admin users that has one

I have an iMac 2017 with a FusionDrive on which FileVault cannot not be enabled. The situation is summed up in this reddit post. The problem boils down to: I have no admin user who has a secure t...

apple.stackexchange.com

Thank you for all the help and info. I need to read through this and try to figure it out, not used to using Terminal and all the commands

Thank you to everyone else also, much appreciated

 

[sparkie7]

UPDATE:

I found this article:

Force Delete user in mac

Force Delete user in mac. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

And it worked! Was able to delete my unwanted User account

Again thanks all for all your help and replies

 

[SimonTheSoundMa]

So, you've deleted the only account with the secure token?

I think I see the error in your ways. Did you format Macintosh HD as APFS encrypted, the install macOS?

 

[sparkie7]

So, you've deleted the only account with the secure token?

Yep. I think I'll back my files up. Completely wipe the drive and start a new Monterey install. I don't like messing around in Terminal

I think I see the error in your ways. Did you format Macintosh HD as APFS encrypted, the install macOS?

What's the error?

I formatted the SSD as APFS encrypted 4-5 years ago. And I turned on FileVault soon after.

I installed Monterey OS just yesterday. But that extraneous user has been on my MacBook Pro for like 2-3 years, just wanted to get rid of it as it doesn't have any data/files on it

 

[gilby101]

I formatted the SSD as APFS encrypted 4-5 years ago. And I turned on FileVault soon after.

The boot disk should just be erased (not encrypted) when installing macOS. Turn on FileVault after install is complete - that will encrypt it.