MacBook Pro admin access taken over by unknown user

Did you buy this MacBook Pro 14" new or used?

If you go to System Settings > General > Device Management should not be signed In to a work / school account and should not have any profiles installed. If you see anything on this Device Management screen then the device is likely enrolled with an MDM server by an employer or educational institution. This is an indication the Mac may be stolen and resold. Another is if you keep seeing a notification indicating this is a Managed Mac? That happens if the Mac wasn't enrolled automatically but is still configured to do so. If the Mac is 'stolen' you are likely going to run into an Activation Lock screen asking for an Apple ID email / password to continue.

I have no idea how a new admin user was created if you are the only user on a Mac you own and is not managed by an MDM - Mobile Device Management server. The account wasn't created for a family member or friend? It is entirely possible for command line scripts to create a new user account, complete with a desktop, home directory and permissions. Meaning some malicious malware may have created this extra account. Although, it is strange that they made it a normal visible user when it's possible to have a user hidden. The very 1st user account created on a Mac is special. It must be an admin account and it contains a magic token that is required to perform privileged operations such as creating a new user that is allowed to boot the operating system, etc.

If your Mac has been compromised (hacked / infected). The best course of action is to backup (hopefully you have backups prior to being compromised. But backup again what you have right now. Then you should factory reset the Apple Sillicon MacBook Pro via System Settings > Transfer or Reset > Erase All Content and Settings. Install any and all software updates. Restore from a Time Machine backup that pre-dates when the Mac was compromised. Then you go and change all your passwords. HIghly recommend a password manager such as 1Password. But Apple Passwords works if you remain entirely within the Apple ecosystem.

If things get very broken and you can't boot the MacBook Pro anymore. You'll need a second working Mac and install Apple Configurator app on the good Mac. Then using a Thunderbolt data cable you put the broken Mac into DFU mode and connect to the good Mac and the broken Mac should appear in Apple Configurator. Now you can revive / reset the Mac using the good Mac to grab the trusted installer and in a trustworthy manner bootstrap the bad Mac. This ensures an un-tampered installation is applied that is signed and sealed by Apple. It is more than an on device factory reset it is a full reset. How to revive or restore Mac firmware - Apple Support

James Brickley wrote:

Did you buy this MacBook Pro 14" new or used?

If you go to System Settings > General > Device Management should not be signed In to a work / school account and should not have any profiles installed. If you see anything on this Device Management screen then the device is likely enrolled with an MDM server by an employer or educational institution. This is an indication the Mac may be stolen and resold. Another is if you keep seeing a notification indicating this is a Managed Mac? That happens if the Mac wasn't enrolled automatically but is still configured to do so. If the Mac is 'stolen' you are likely going to run into an Activation Lock screen asking for an Apple ID email / password to continue.

I have no idea how a new admin user was created if you are the only user on a Mac you own and is not managed by an MDM - Mobile Device Management server. The account wasn't created for a family member or friend? It is entirely possible for command line scripts to create a new user account, complete with a desktop, home directory and permissions. Meaning some malicious malware may have created this extra account. Although, it is strange that they made it a normal visible user when it's possible to have a user hidden. The very 1st user account created on a Mac is special. It must be an admin account and it contains a magic token that is required to perform privileged operations such as creating a new user that is allowed to boot the operating system, etc.

If your Mac has been compromised (hacked / infected). The best course of action is to backup (hopefully you have backups prior to being compromised. But backup again what you have right now. Then you should factory reset the Apple Sillicon MacBook Pro via System Settings > Transfer or Reset > Erase All Content and Settings. Install any and all software updates. Restore from a Time Machine backup that pre-dates when the Mac was compromised. Then you go and change all your passwords. HIghly recommend a password manager such as 1Password. But Apple Passwords works if you remain entirely within the Apple ecosystem.

If things get very broken and you can't boot the MacBook Pro anymore. You'll need a second working Mac and install Apple Configurator app on the good Mac. Then using a Thunderbolt data cable you put the broken Mac into DFU mode and connect to the good Mac and the broken Mac should appear in Apple Configurator. Now you can revive / reset the Mac using the good Mac to grab the trusted installer and in a trustworthy manner bootstrap the bad Mac. This ensures an un-tampered installation is applied that is signed and sealed by Apple. It is more than an on device factory reset it is a full reset. How to revive or restore Mac firmware - Apple Support

+ + + 1

🦉

Jack_Nokleby wrote:

Hi,

I have a 2024 Mac book pro 14' running sequoia 15.6.1.

Somehow I lost administrative privileges to my apple account. There is another user on there that I do not remember ever creating that is now the "admin". How do I regain control from an account with a password that I don't even know. Paid quite a bit for this computer and would like to........ you know be able to use for its intended purpose. Do I have to do a complete reboot? If so, how does someone go about doing that?

[Edited by Moderator]

Original Title: Lost admin access

There can be Two Administrator Accounts on one computer

The second admin account can be added by the " Owner Account " of this computer.

Set up users, guests, and groups on Mac

Normally the " Owner Account  " is the very first account used, when the Computer was Very First Setup as New and out of the box.

Is it possible, that during the Initial Setup of this computer you Transferred your information to Mac from another computer or device

Bringing over everything from another computer to this machine including the Admin Account ?

If I were in the same situation, which I am not

I would suggest to explore all the advise that was supplied by @ James Brickley

They seem to have, almost every possible scenario covered