{"id":75404,"date":"2023-06-05T13:09:31","date_gmt":"2023-06-05T17:09:31","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&p=75404"},"modified":"2025-03-20T08:57:15","modified_gmt":"2025-03-20T12:57:15","slug":"install-and-use-the-service-account-for-macos","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/install-and-use-the-service-account-for-macos","title":{"rendered":"Install and Use the Service Account for MacOS"},"content":{"rendered":"\n
探花大神 leverages a service account to ensure that 探花大神-managed users on macOS devices can unlock FileVault encryption. Before 探花大神 can provide FileVault access to 探花大神-managed users, the 探花大神 Service Account must be created to provide its crucial function of granting new users secure tokens. This service account is created during the 探花大神’s agent installation process, or may be automatically installed at user login.<\/p>\n\n\n\n
Apple File Systems (APFS) in macOS 10.13 changed the way Apple manages FileVault encryption keys. To secure and provide access to encryption keys, which are required for FileVault decryption, Apple introduced secure tokens<\/a>.<\/p>\n\n\n\n Secure tokens are granted to the macOS users who create a local account using Apple’s Setup Assistant for the first administrative user, and then subsequently through Apple’s Users & Groups<\/strong> pane in System Settings<\/strong>. Apple’s Deployment Reference for Mac<\/a> describes additional methods in which a system account may be granted a secure token. Users with a secure token may enable and manage FileVault on a macOS system, and users created by these users are also given secure tokens via a chain of trust methodology.<\/p>\n\n\n\n The 探花大神 Service Account is installed as a system account whose sole purpose is the management of secure tokens for 探花大神-managed accounts. As a service account, its context is to provide security-level services to other user accounts managed by 探花大神, and it can’t be logged in to by other users \u2014 the 探花大神 Service Account doesn’t have an accessible password or valid home directory.<\/p>\n\n\n\n The 探花大神 Service Account is configured through the 探花大神 Service Account Utility. The 探花大神 Service Account Utility will launch automatically after MDM-driven enrollments, and can also be launched manually from the \/Applications folder on the user\u2019s device. The app will only successfully open if it doesn\u2019t detect a service account on the device. If the user tries to launch it while a service account is present, the 探花大神 Service Account Utility will not launch.<\/p>\n\n\n\n This service account is also used to rotate the FileVault Recovery Key when using FileVault 2. See Create a Mac FileVault 2 Policy<\/a>. Additionally, 探花大神 provides Recovery Key escrow through MDM.<\/p>\n\n\n\n The Service Account can be installed automatically<\/a> by 探花大神 or manually<\/a> by administrators. <\/p>\n\n\n\n 探花大神 automatically installs a service account when an administrator-level user logs in to the Mac device. During login, the 探花大神 Agent silently verifies that a service account exists. If one does, no action is taken. If not, the 探花大神 Agent uses the credentials of the logged-in user to instantiate it. These credentials are not stored anywhere on the device in plain text. They are securely captured during the login process and passed directly to the agent. <\/p>\n\n\n\n For 探花大神 to be able to automatically install the service account at login, the following is required:<\/p>\n\n\n\n If the service account can’t be installed automatically, the Service Account Utility will launch and prompt for admin account credentials to complete the creation of the 探花大神 Service Account. See Resolving a Service Account Prompt<\/a> below.<\/p>\n\n\n\n For 探花大神 to manage users on systems, the following must be true:<\/p>\n\n\n\n When installing the agent using the package installer, it’s necessary to provide credentials for a natively created administrator account with secure token enabled. A secure token is granted to the first user to log in to a system created by the Setup Assistant. To check the secure token status of this user, run the following command in Terminal:<\/p>\n\n\n\n # sysadminctl interactive -secureTokenStatus SECURETOKEN_ADMIN_USERNAME This command can be run using the 探花大神 agent and it’s available for import<\/a> using the 探花大神 PowerShell Module. <\/p>\n\n\n\nUsing the 探花大神 Service Account<\/h2>\n\n\n\n
Expected Behavior<\/h3>\n\n\n\n
\n
Installing the 探花大神 Service Account<\/h2>\n\n\n\n
Installing Automatically<\/h3>\n\n\n\n
\n
Installing Manually Using the Service Account Utility<\/h3>\n\n\n\n
\n
\n
# SecureToken is ENABLED for user SECURETOKEN USER<\/p>\n<\/div><\/div>\n\n\n\n