We are enrolling macOS laptops using Apple Automated Device Enrollment for our enterprise rollout. As part of the ADE profile, we have configured a local admin account for first-time setup. Now we have a few operational concerns. For already enrolled laptops, we want to manage or remove existing local accounts and also change the admin password used in the ADE profile for future enrollments. We are trying to understand whether these ADE-created accounts can be edited or deleted post enrollment, and what the recommended approach would be to avoid security or compliance issues going forward.
Unable to Edit or Remove ADE-Created Local Admin Account on macOS DevicesSolved
Tags
Replies (3)
Thanks for reaching out to Hexnode Connect with your detailing use case. I understand how important account control is, especially in large-scale deployments.
For devices that are already enrolled in Hexnode UEM, you can manage local user accounts from Manage > Devices > Local Accounts, where standard local users can be modified or removed as needed.
However, local accounts that are created as part of the ADE enrollment profile itself cannot be edited or deleted individually after enrollment. The ADE profile does not support modifying or removing those preconfigured accounts. For future enrollments, you can create additional local accounts, but existing ADE-created users remain unchanged.
I hope it clears the situation. Please feel free to contact us if you need any further assistance.
Best regards,
George
Hexnode UEM
Understood. If deleting the ADE profile is the only way to remove those existing accounts, would that cause any disruption to the already enrolled devices or impact management in any way? We want to be sure this does not introduce new issues before proceeding.
Hello,
That is a valid concern. Deleting the ADE profile will not impact devices that are already enrolled or managed. However, it is currently the only method available if you need to remove the existing ADE-created local accounts entirely. At the moment, there is no option to directly edit or delete those accounts post enrollment.
I have forwarded this case to our engineering team, as we understand the operational value of being able to manage ADE-created local users more flexibly. We will keep you informed and update this thread as soon as there is any progress or change in the workflow.
Please feel free to reach out if you need assistance with alternative approaches in the meantime.
Best Regards,
George
Hexnode UEM