Manage Local Admin Accounts Remotely in macOS 13

Yes, you can configure local administrator accounts remotely in macOS 13 (Ventura). This guide explains the primary methods used to create, modify, and manage local administrative credentials remotely, focusing on Mobile Device Management (MDM) solutions, command-line utilities via Secure Shell (SSH) or Apple Remote Desktop (ARD), and the critical role of Secure Tokens and Bootstrap Tokens in modern macOS environments.

1. Using Mobile Device Management (MDM)

The most secure and scalable way to manage local accounts on macOS 13 is through an MDM solution (such as Jamf Pro, Microsoft Intune, or Kandji).

  • Automated Device Enrollment (ADE): During initial device setup, MDM can deploy a pre-configured, hidden, or standard local administrator account.
  • Local Administrator Password Solution (LAPS): Many MDMs support automated password rotation for local administrator accounts, ensuring each managed Mac has a unique, centrally managed password.
  • Declarative Device Management (DDM): macOS 13 supports declarative management, allowing MDMs to autonomously enforce account configurations and monitor status updates without continuous polling.

2. Using Command-Line Tools via SSH or Apple Remote Desktop

If MDM is not available, administrators can use remote command execution through SSH or Apple Remote Desktop. In macOS 13, modifying accounts requires tools that properly interact with Apple’s security architecture.

Using sysadminctl

The sysadminctl tool is the standard command-line utility for managing users while handling Secure Tokens.

  • Create a new administrator:

    sudo sysadminctl -addUser <admin_username> -fullName "<Full Name>" -password "<Password>" -admin

  • Promote an existing standard user to an administrator:

    sudo sysadminctl -adminUser <existing_admin> -adminPassword <password> -addUser <target_username> -admin

  • Delete a local administrator account:

    sudo sysadminctl -adminUser <existing_admin> -adminPassword <password> -deleteUser <target_username>

Limitations of dscl

While the directory service command-line utility (dscl) can add a user to the admin group using dseditgroup or dscl . -append /Groups/admin GroupMembership <username>, this method does not grant cryptographic capabilities like Secure Tokens or Volume Ownership, which are required for FileVault and system updates.

3. Understanding Secure Token and Bootstrap Token Requirements

In macOS 13, local administrator management is tightly coupled with APFS volume ownership and Secure Tokens, especially on Apple Silicon hardware:

  • Secure Token: A local admin created without a Secure Token cannot unlock FileVault, authorize system updates, or manage other users' tokens. Creating an admin via sysadminctl typically requires authentication from an existing Secure Token-enabled user.
  • Bootstrap Token: For fully automated or headless environments, an MDM escrowed Bootstrap Token must be present. The Bootstrap Token allows macOS to grant a Secure Token to newly created local accounts automatically, bypassing the need for manual credential entry from an existing admin.