macOS Secure Token Is Disabled for User: What It Means and How to Fix It

If you’ve encountered a message like “Secure Token is disabled for user” on macOS — especially when trying to enable FileVault disk encryption, install updates, or perform account management — it points to a core part of macOS security not being assigned properly to that user account.

This article explains what Secure Token is, why it matters, what can cause it to become disabled, and how you can resolve related issues. We also provide practical steps (including Terminal commands) for checking and fixing Secure Token status on macOS.

What Is a Secure Token on macOS?

Secure Token is an account attribute introduced in macOS High Sierra (10.13) and later that controls access to privileged system features. It is required for:

• Enabling and managing FileVault full-disk encryption on APFS volumes
• Performing certain administrative tasks such as password resets and account creation
• Granting access to sensitive system operations that require elevated trust

A Secure Token is tied to a user’s password and acts as a key-enabling attribute for secure operations. DataJar Support

Whenever a new Mac is set up normally, the first user account created receives a Secure Token automatically. Subsequent users will only be granted a Secure Token if an existing Secure Token user (typically an administrator) explicitly grants it. Apple Support

Why Does “Secure Token Is Disabled for User” Happen?

There are several reasons a user might lose Secure Token or never receive it in the first place:

1. System Upgrade or Migration

When migrating from older versions of macOS or converting accounts, Secure Token may not be applied automatically. All Os Guru

2. User Created Without Admin Rights

If a user is created without administrative privileges, it might never get a Secure Token. All Os Guru

3. Directory Service or Account Sync Issues

Accounts managed via directory services (like Active Directory or LDAP) can sometimes interfere with Secure Token status. All Os Guru

4. Password Resets or Token Breakage

Changing or resetting a password (especially via recovery tools) can break the Secure Token association, leaving it disabled or corrupted. Addigy Support

5. FileVault and Token Sequence Problems

If FileVault encryption is turned off incorrectly or without a Secure Token user being properly configured, some users may be left without tokens. All Os Guru

Why Secure Token Matters

Without a Secure Token:

• The user cannot enable FileVault encryption
• They may be unable to unlock encrypted volumes
• Certain system updates may prompt authentication to fail
• Administrative tasks like password changes can be restricted
• FileVault-related recovery and key escrow may not work correctly

This is intentionally designed to protect encrypted data and ensure only trusted accounts can perform sensitive actions. DataJar Support

How to Check Secure Token Status

You can check whether a user has a Secure Token via Terminal:

1. Open Terminal
2. Run the command:

sudo sysadminctl -secureTokenStatus <username>

Replace <username> with the short name of the account.
The output will say either “Secure token is ENABLED” or “Secure token is DISABLED”. DataJar Support

How to Fix “Secure Token Is Disabled for User”

If Secure Token is disabled for a user, here are reliable ways to fix it:

Method 1: Enable Secure Token Using an Existing Token User

To grant Secure Token to an account, you need another user on the system who already has a Secure Token — usually an existing admin.

1. Log in as the admin user with Secure Token
2. Open Terminal
3. Run the command:

sudo sysadminctl -adminUser <secureAdmin> -adminPassword <adminPass> -secureTokenOn <targetUser> -password <targetPass>

Replace:

• <secureAdmin> with the admin username who has Secure Token
• <adminPass> with that admin’s password
• <targetUser> with the username needing a token
• <targetPass> with that user’s password

After running this, re-check the token status. Addigy Support

Method 2: Use FileVault Preferences (GUI Approach)

If the primary admin user already has a Secure Token, enabling FileVault for the disabled user can trigger a Secure Token assignment:

1. Go to System Settings → Privacy & Security → FileVault
2. Turn FileVault On
3. Select the users who should be allowed to unlock the disk and enter their passwords for approval

macOS will grant Secure Tokens to the selected accounts as part of the FileVault enablement process. DataJar Support

Method 3: Use Recovery Mode (Advanced)

If no admin user on the machine has a Secure Token, hitting a dead end, you may need to boot into Recovery Mode and create or configure an account with Secure Token capability. This can involve:

• Re-running the Setup Assistant
• Creating a new admin account that will automatically receive a token
• Promoting and then demoting users after token assignment

This is a more advanced route and should be approached carefully with backups.

Special Notes on Bootstrap Token

In managed environments (such as MDM via Apple Business Manager), macOS can use a bootstrap token to automate the creation and escrow of Secure Tokens for mobile or network accounts. This mechanism allows new users to receive tokens without manual steps from an existing token holder. SOTI+1

Common Scenarios Where This Issue Appears

Unable to Turn On FileVault

A user without Secure Token will be excluded from the list of users authorized to unlock an encrypted disk.

Authentication Errors during System Update

Without a valid token, macOS may display “Authentication is disabled” when users try to approve system changes or updates. Jamf Support Portal

Device Management Enrollment Failures

In some enterprise enrollment workflows, accounts created via scripts or MDM might not receive tokens unless specifically configured.

Best Practices

• Ensure at least one admin user always has a Secure Token
• When creating new local users, assign admin roles if they should receive Secure Tokens
• Always run software updates — macOS patches and token behavior can evolve over versions
• For managed fleets, use bootstrap token and MDM profiles to streamline token provisioning

Conclusion

A Secure Token disabled for a user can block access to key macOS features like FileVault encryption, administrative tasks, and secure authentication. The root cause often stems from how accounts were created, password changes, or migrations from older systems.

By using built-in tools like sysadminctl, enabling tokens via admin accounts, or appropriately configuring FileVault or bootstrap token automation, you can rectify the issue and restore full security functionality for macOS user accounts.