There is an issue reported on slack that sysadminctl has issues on 10.13.2. Scripts based on dscl are supposed to be working better.
Not tried myself, but this may help you better over there:
https://macadmins.slack.com/archives/C060SPREF/p1512767232000458
Jayson Kish
OK.
In 10.13.1 I could create an admin account and local standard account using sysadminctl using a bash script that ran on enrollment with JAMF Pro. Neither would get SecureToken, but I could enable FileVault on deferment and the first mobile account to login would get it instead.
This was a livable workaround, as it was the behavior I needed.
Starting with 10.13.2, you cannot create an account using sysadminctl without first providing an administrator user name and password, which in my case, doesn’t exist.
So I now have to create my administrator account in the PreStage Enrollment, then include that administrator’s user name and password in my bash script to create my local standard account (annoying, but livable since the passwords are later changed by another policy).
The tradeoff here though is that both the administrator and standard account get SecureToken, but my mobile account no longer does.
Thanks Apple.
Does anyone here have a good solution for enabling SecureToken for mobile accounts and enabling FileVault at the time of login?
Posted in #filevaultDec 8th at 10:07 PM
