> Source: [sk122674](https://support.checkpoint.com/results/sk/sk122674)

# sk122674 - How to manage user acquisition of mobile accounts using FDE on macOS 10.13 or higher

| Property | Value |
|----------|-------|
| Solution ID | sk122674 |
| Date Created | 2018-01-30 |
| Last Modified | 2023-05-24 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | macOS |

## Solution

The following applies to macOS 10.13 or higher:

* User can not be added to Apple FileVault unless it has a *secure token*.
* When mobile accounts are created, they do not receive *secure token*.
* Starting with macOS 10.13.4, in the user setup wizard, a *secure token* can optionally be created by authentication from a local administrator. If the dialog button *Bypass* is pressed, the dialog will not appear again.
* Mobile accounts created in macOS before 10.13.4 will not have *secure token*.

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk122674/Apple_securetoken_auth1803260900.png)

The following applies to Endpoint Security Native Encryption Management (NEM) blade:

* During user acquisition, after each login, whenever*secure token* is missing, NEM allows creation of secure token by requesting authentication from a local administrator.
* If authentication is cancelled, the dialog will appear at next login.

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk122674/CP_securetoken_auth1803260907.png)

How To avoid authentication from local administrator during user acquisition - *nemcontrol*
-------------------------------------------------------------------------------------------

* A local admin can SSH to the machine and execute *nemcontrol* as sudo. Once the utility is executed, NEM will not need to request authentication from local administrator anymore. NEM will seamlessly add any mobile account to FileVault.
* The command will create a hidden local admin account, fdetemp, that has secure token.
* The hidden account is time-limited and will not appear in macOS or FileVault login screens.
* Later, when NEM has finished user acquisition, the hidden account will be automatically removed.
* The utility can preferably be run before installation. In case it is run after installation, via SSH, at the same time as NEM has requested authentication from local administrator, the mobile user needs to logout and re-login again.
* Internally, NEM uses the hidden account to enable *secure token*of all other mobile accounts.

### nemcontrol usage

Note, The installed macOS must have a user with administrative privileges with a secure token already assigned. This is often the initial local administrator of the installed macOS. To find out if an administrator account has *secure token*:

`sudo sysadminctl -secureTokenStatus <local-admin>`

To create the temporary hidden user:

`sudo /Library/Application\ Support/Checkpoint/Endpoint\ Security/nemControl create-fdetemp-user -u <local-admin-with-securetoken> -p <local-admin-with-securetoken-password> [-t <hidden-account-expiration-hours>]`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content