As a part of standard security audits, we like to rotate the local admin password we have on our mac computers every so often. This worked well enough a year ago, however I did notice some outlier computers where there was an error saying that the admin password could not be changed due to the Secure Token. When I most recently tried to run the same script that previously worked, not only did it not change the local admin password, it seems to wipe it completely where I can no longer login using either the new or old passwords.
I've tried many different workarounds to try and get the local password to change, including using Jamf's built in Local Account Management policy, and using scripts with the sysadminctl command and have thus far been unsuccessful. Some things I found in my reserach are that there must always be an admin account present on a mac, and one client must always have a SecureToken assigned before login. The most recent workaround I tried is listed below, wherein I created a new local admin account using Local Account Management (admintemp), and then tried to use that admin account to turn off the SecureToken for the administrator before changing the password and re-enabling it.
sysadminctl -secureTokenOff administrator -Password $LOCALADMINPASSWORD -adminUser admintemp -adminPassword $ADMINTEMPPASSWORD
sysadminctl -adminUser admintemp -adminPassword $ADMINTEMPPASSWORD -resetPasswordFor administrator -newPassword $NEWPASSWORD
sysadminctl -secureTokenOn administrator -password $NEWPASSWORD -adminUser admintemp -adminPassword $ADMINTEMPPASSWORD
My plan was to just delete the admintemp account once I was done, but I can't even get the local admin password to change no matter what I do. I also tried to just delete the local admin account and re-create it with the new password I want, but that didn't work either because the account has a secure token.
If anyone has suggestions, please help! Local admin password rotations are a standard IT practice and I refuse to believe that Apple has made it this complicated to do.