Managing administrator accounts

Managing administrator accounts in Primo allows you to create and manage administrator accounts on your devices, with options to set usernames and passwords, while specifying that policies can be edited or disabled, but cannot be changed once enabled on a profile.

2 min read

Introduction

Managing administrator accounts in Primo allows you to create default administrator accounts (sessions) on the devices in your fleet.

Once enabled, this feature allows you to create administrator accounts globally or granularly across your entire fleet, depending on your teams and your profiles.

Concretely:

➡️ An administrator session is created on the computer with the chosen name

➡️ The password is stored in the panel of the devices concerned

➡️ Existing user rights are not changed

👉
Coming soon: the ability to reduce user privileges and facilitate privilege escalation (giving temporary administrator access).

Feature Detail

Initial scenario:

Implementation of the policy:

  1. Enable this feature
  1. Set the username (session name) for the account to be created
  1. Set the account password
    1. use a random password* (1)
    1. use a fixed password* (2)

*(1) Random password: Passwords are stored in the panel of each device (Equipment > Devices > Panel of each device).

*(2) Fixed password: the password is stored in the setting modal (Profiles > Relevant profile > Administrator account management)

Policy Change:

⚠️
Once enabled on a Profile, the policy is no longer editable. To change it, you must deactivate it and then reactivate it.

Disabling the policy stops forcing it to work on affected machines, but does not delete it. The Primo admin account and its password remain stored in Primo.

Special cases

Remove administrator access on a device with the secure token active

SecureToken is a macOS feature that acts like an access key. It allows a user account to enable and manage critical security features, such as FileVault encryption. Currently, it is not possible to remove administrator rights from an account if that account is the only one with a SecureToken on the device. We are working to improve this management to allow the SecureToken to be transferred to another account, including one administered via Primo.

Cases of devices targeted by multiple administrator account management policies

Duplicate policies can occur if you enable the policy on a global profile and a "specific" profile. In this case, Primo does not handle the conflict: the MDM attempts to create the requested user by checking only that the account name is not identical.

Did this answer your question?

    Step into the future of IT