Apple Silicon without local Admin.

[TheTechnicalSpecialist]

Hi.

Can Erase-install take care of upgrading major macOS versions on a Apple Silicon Mac if the only accounts are a 1 local standard account (with secure token and volume ownership) and the (hidden) jamf (mdm) admin account (without secure token)? (enrolled via Prestage Automated Device Enrollent (DEP), but mac needs to be remote and Admins will not be able to be physically near the mac)

[grahampugh]

@TheTechnicalSpecialist That will only be possible if you can Remote Desktop into the Mac. Because you need to supply the password of the local standard account via a GUI prompt.

[TheTechnicalSpecialist]

Apologies I think i didn't make myself clear... The end-user is a real person. But that user just doesn't have admin rights. The admins/engineers are not ever going to be near the Mac itself.

But i guess the answer is yes. Cause if you can remote into the mac and use the local standard account, then you can also do it with a real person.

Now i would need to find out what the best Jamf Pre-stage config would look like for that scenario, so that we can use a zero-touch deployment...

[grahampugh]

Correct, the user does not have to be an administrator, just needs to be a Volume Owner.