We have our prestage enrollment set to create a hidden local admin account. The settings we have selected are: Create a local admin account before setup assistant, Hide managed admin account in Users & Groups, and Skip Account Creation.
Initially, this seems to work 100% fine. I can log in through the local admin without issues. BUT, as soon as another user uses the computer and it creates their account, I suddenly lose access to the local admin. Let me walk you through this so it makes more sense.
- The computer goes through prestage enrollment and creates the admin account.
- When we reach the login screen it is populated with our Single-Sign On window asking for our company email login. We instead click local login and log in with the local admin. This works.
- We log out of the local admin and return to the SSO login window. The new computer user will log in with their company credentials and it will create and account for them on the computer. They log out of the account.
- The admin account no longer has access or has somehow changed passwords.
I have to assume something in our settings is making this happen but I can't figure it out. My original test machines are not having this issue, but I haven't made any changes to policies or configurations that should have had an impact. All I've done is add more programs for availability.
I even did a full factory reset, deleted from Jamf, and started a computer fresh today and it worked exactly like I described above, which means something must be writing over the local admin at some point when the new user logs in, but I for the life of me can't figure it out and it's hurting our whole program.