No admin account on T2 MacBook with Big Sur

Surrealdeal Said:

"No admin account on T2 MacBook with Big Sur: Unable to create missing admin account. I’m working on an A1989 T2 MacBook Pro on Big Sur, with no admin account. I am trying to forensically image it and need admin rights to run the imaging software on it, boot it to the imaging tool or to unlock the drive in TDM to image via another Mac."

-------

Boot into Recovery Mode:

In Recovery Mode, you will be prompted to enter a password. See what user is shown, and if a password that you enter works.

If you were able to remove the Firmware Password Lock does this mean you were able to boot into Recovery Mode or Internet Recovery Mode? If so, then launch the Startup Security Utility and enable the option to boot from a USB drive. Boot from a USB drive to attempt to access the data on the internal SSD.

If you cannot boot into Recovery Mode or Internet Recovery Mode, then there is nothing else you can do if Target Disk Mode does not work. You can try contacting a professional data recovery service such as Drive Savers or Ontrack to have them attempt to make a forensic image. Both vendors provide free estimates and both are recommended by Apple.

Unfortunately Apple's implementation of the security features on the T2 Macs is buggy and broken. I had one of our organization's Macs which had two admin user accounts on it. I was able to boot normally and log into both accounts without issue. However, when I attempted to boot into Recovery Mode and Internet Recovery Mode I was unable to complete the task due to authentication issues. I was only prompted for one of the two admin user accounts and neither password word work to authenticate in Recovery Mode. I ended up deleting one of the admin user accounts and tried Recovery Mode again. I was still only presented with the user name for the now deleted admin account. I entered the password and it was accepted so I could finish booting into Recovery Mode (I don't recall which of the two admin user account passwords I used -- I think it was the password for the now deleted admin user account).

Keep in mind that you will need to authenticate in order to allow the T2 security chip to decrypt the internal SSD which is hardware encrypted by the T2 security chip. There are a lot of ways to lose access to data on a T2 Mac.

When you deleted the ".AppleSetupDone" file was the process successful or was there an error message? You may need to temporarily disable SIP first, but make sure to re-enable SIP after you are finished deleting the file. I have not tried to do delete the ".AppleSetupDone" file from Big Sur, but it did work for Catalina.

Surrealdeal wrote:

Were you just suggesting I disable SIP to be able to delete the .AppleSetupDone file?

Correct. I recall I had to disable SIP to delete the file while booted into Recovery Mode with Catalina. I've never tried to delete the file from Big Sur or from a T2 Mac so I'm not sure if there would be any differences.