I just came into the same situation. But I was lucky enough to workaround it last night. It took me 2 nights searching around to figure out what to do. Here's what you need:我刚刚遇到同样的情况。但我很幸运昨晚解决了这个问题。我花了两个晚上四处寻找才能弄清楚该怎么做。这就是你需要的：

*. A functioning Mac(Better without a T2 chip), mine is the 2014 Mac Mini. Edit: For T2 chip devices, you could temporarily set the security options to allow boot from external devices.(Reboot and then Command + R,not personally tested)*。一台正常运行的Mac（没有T2芯片更好），我的是2014 Mac Mini。编辑：对于T2芯片设备，您可以临时设置安全选项以允许从外部设备启动。（重新启动然后Command + R，未经个人测试）

*. An SSD for a fresh install.*。用于全新安装的 SSD。

*. Create a bootable macOS USB drive.*。创建可启动的 macOS USB 驱动器。

I will make it short. You could search for tutorials if you don't know what to do for a certain step.我会简短地说。如果您不知道某个步骤该怎么做，您可以搜索教程。

1. Plug in both SSD and bootable USB drive(with Mojave installer).插入 SSD 和可启动 USB 驱动器（带有 Mojave 安装程序）。

2. Reboot your mac and press Command + R.重新启动 Mac 并按 Command + R。

3. Install a fresh Mojave on your SSD, and stop when you see the welcome screen where it asks you to select your country.在 SSD 上安装新的 Mojave，当您看到欢迎屏幕并要求您选择所在国家/地区时停止。

4. Power off and unplug the SSD off your functioning Mac.关闭正在运行的 Mac 的电源并拔下 SSD。

5. Plug your SSD onto your MBP and turn it on.将 SSD 插入 MBP 并打开它。

6. Press Command + R and enter the recovery mode.按 Command + R 并进入恢复模式。

7. Disk Utilities -> Restore. Here select your SSD and it will copy your SSD's files onto your MBP. And then you can unplug your SSD.磁盘实用程序 -> 恢复。在这里选择您的 SSD，它会将 SSD 的文件复制到您的 MBP 上。然后你就可以拔掉你的SSD了。

8. You could try select your internal drive as start up disk but it doesn't let you to. So reboot your MBP. And press Command + R. In my case it failed to boot the macOS and it just reboot into the recovery mode again.您可以尝试选择内部驱动器作为启动磁盘，但它不允许您这样做。所以重启你的MBP。然后按 Command + R。就我而言，它无法启动 macOS，只是再次重新启动进入恢复模式。

9. Select Install Mojave. After a couple of minutes, your screen turns black and it reboots.选择安装 Mojave。几分钟后，屏幕变黑并重新启动。

10. You will see the lovely Welcome screen again.您将再次看到可爱的欢迎屏幕。

I had to boot into recovery mode and reinstall High Sierra (the initial shipped version of macOS). Installing HS gave an administrator account. With the administrator account I was able to allow booting from any external device and finally booted from mac USB stick macOS mojave. After that I could remove HS.我必须启动进入恢复模式并重新安装 High Sierra（macOS 的初始发布版本）。安装 HS 会获得管理员帐户。使用管理员帐户，我可以允许从任何外部设备启动，并最终从 mac USB 记忆棒 macOS mojave 启动。之后我就可以删除 HS。

I had a similar issue with my 2018 Mini: I had to delete the .AppleSetupDone file and run the "Welcome to Mac" routine, creating a new admin user there before I could alter SecureBoot, even though the disk had been imaged with an admin user.我的 2018 Mini 也遇到了类似的问题：我必须删除 .AppleSetupDone 文件并运行“欢迎使用 Mac”例程，在更改 SecureBoot 之前创建一个新的管理员用户，即使磁盘已使用管理员进行映像用户。

Peter Thorn's answer here gets to the exact cause of the problem and provides the solution for a working Mac that has MacOS installed.Peter Thorn 的回答找到了问题的确切原因，并为安装了 MacOS 的 Mac 提供了解决方案。

If you don't have MacOs installed, you could try booting it in Target Mode from another Mac, which I understand bypasses the Secure Boot! (Though if the drive is encrypted, you'll need the password, unless you're wiping it anyway.)如果您没有安装MacO，您可以尝试从另一台Mac以目标模式启动它，据我所知，这会绕过安全启动！ （尽管如果驱动器已加密，您将需要密码，除非您无论如何都要擦除它。）

Alternatively, take it to an Apple Store. The SecureBoot settings can't be changed unless there is a valid admin user, so you can't boot to an external. Recovery is another option, but you say that's not working.或者，将其带到 Apple Store 零售店。除非有有效的管理员用户，否则无法更改 SecureBoot 设置，因此您无法启动到外部。恢复是另一种选择，但你说这不起作用。

PS. I'd love to work somewhere where you get to keep your laptop when you resign!附言。我很想在辞职时可以保留笔记本电脑的地方工作！                                                

To my experience, it is a question of Secure Tokens, if it doesn't accept the admin even though it has the shipped (old) macOS installed from the recovery partition.根据我的经验，如果它不接受管理员，即使它已经从恢复分区安装了附带的（旧）macOS，那么这就是安全令牌的问题。

Even though you have created an admin account, you need it to have a Secure Token and update the preboot, for the recovery partition to accept it.即使您已经创建了管理员帐户，您也需要它拥有安全令牌并更新预引导，以便恢复分区接受它。

I did the following (when logged in as the local admin account) (both commands run in Terminal):我执行了以下操作（当以本地管理员帐户登录时）（两个命令都在终端中运行）：

sysadminctl interactive -secureTokenOn [admin user shortname] -password -                                                

(you will be asked to authenticate).（系统会要求您进行身份验证）。

diskutil apfs updatePreboot /                                                

I managed to get around this by using Disk Utility (from recovery mode) to "restore" my internal drive with the image on my external bootable drive. Voila, your bootable drive is no longer "external" and you can boot from it. You'll probably want to create a separate partition on your internal drive for the bootable partition to install to; ideally your second partition is the installer so that you can delete it later without the "you can't remove the first volume on the disk" error.我设法通过使用磁盘工具（从恢复模式）使用外部可启动驱动器上的映像“恢复”我的内部驱动器来解决此问题。瞧，您的可启动驱动器不再是“外部”驱动器，您可以从它启动。您可能需要在内部驱动器上创建一个单独的分区，以便安装可引导分区；理想情况下，您的第二个分区是安装程序，以便您稍后可以将其删除，而不会出现“您无法删除磁盘上的第一个卷”错误。

A friend of mine got one of those corporate-managed MacBooks I think it was Meta so it will always go back to being managed by Meta. Anyhow with the T2 chip and security enabled so cannot boot from external devices. So the MacBook is a brick - re-installing it with any version of MacOS will will make it Meta controlled and she cannot log in as it's linked to Meta corporate accounts. So the only solution was to install Linux on it to make it useful.我的一个朋友买了一台企业管理的 MacBook，我认为它是 Meta 的，所以它总是会回到由 Meta 管理的状态。无论如何，T2 芯片和安全性已启用，因此无法从外部设备启动。因此，MacBook 是一块砖头 - 使用任何版本的 MacOS 重新安装它都会使其受到 Meta 控制，并且她无法登录，因为它链接到 Meta 公司帐户。所以唯一的解决办法就是在上面安装Linux以使其发挥作用。

This is how I achieved disabling the security:这就是我禁用安全性的方法：

1. Start with 

   command

    + 

   R

    以 + 开头 
2. At the start up utility go to Utils and select Terminal在启动实用程序中，转到实用程序并选择终端
3. Either 

   dd /dev/disk1                                                        

    or 

   #rm -rf /                                                        

    dd /dev/disk1 或 #rm -rf /。 
4. Start the Mac and it will go for internet recovery, connect it to your Wi-Fi and let it do its job启动 Mac，它将进行互联网恢复，将其连接到您的 Wi-Fi 并让它完成其工作
5. It will install Mojave whatever it is called. At the next start, just DO NOT connect it to the internet and just select not connected, the installation will go ahead and it will create a new admin user它将安装 Mojave，无论它叫什么。下次启动时，不要将其连接到互联网，只需选择未连接，安装将继续进行，并将创建一个新的管理员用户
6. Once logged in, don't connect to the internet yet.登录后，暂时不要连接到互联网。
7. Shutdown and restart with 

   command

    + 

   R

   使用 + 关闭并重新启动
8. This time you can just go to startup security and enter your password and disable the security and you can now boot from an external USB and install your Linux distro.这次您只需进入启动安全性并输入密码并禁用安全性，然后您就可以从外部 USB 启动并安装 Linux 发行版。

ME 1 Meta IT 0ME 1 元 IT 0

I was able to get to recovery mode by starting to select a start up disk and then quitting with Command - Q                                                    . Took me back to recovery mode and I was able to install Mojave on the internal drive.我能够通过开始选择启动磁盘然后使用 Command - Q 退出来进入恢复模式。带我回到恢复模式，我能够在内部驱动器上安装 Mojave。

(I had this exact issue and foolishly wiped the drive not realizing that the security was set to only internal drives.)（我遇到了这个确切的问题，并愚蠢地擦除了驱动器，没有意识到安全性仅设置为内部驱动器。）

William Tong’s answer is great, but similar to commenter, I could still not boot into recovery with the blank Mojave’s SSD. It would prompt that it couldn’t boot from external drive and to choose a startup disk or restart.William Tong 的回答很好，但与评论者类似，我仍然无法使用空白的 Mojave SSD 启动恢复。会提示无法从外部驱动器启动，需要选择启动盘或重新启动。

After referencing this article on Apple: https://discussions.apple.com/thread/8509743                                                     and going through all three of that thread's recommendations:参考了有关 Apple 的这篇文章：https://discussions.apple.com/thread/8509743 并浏览了该线程的所有三个建议：

1. Enable secure token in Terminal using the command:使用以下命令在终端中启用安全令牌：

   sysadminctl interactive -secureTokenOn <user name> -password <user password>                                                        

   This threw the following error:这引发了以下错误：

   2022-10-20 11:00:27.406 sysadminctl[1137:7904] setSecureTokenAuthorizationEnabled error Error Domain=com.apple.OpenDirectory Code=5101 "Authentication server refused operation because the current credentials are not authorized for the requested operation." UserInfo={NSUnderlyingError=0x600000c41350 {Error Domain=com.apple.OpenDirectory Code=5101 "No existing unlock record" UserInfo={NSDescription=No existing unlock record}}, NSLocalizedDescription=Authentication server refused operation because the current credentials are not authorized for the requested operation., NSLocalizedFailureReason=Authentication server refused operation because the current credentials are not authorized for the requested operation.}                                                        

2. Toggle FileVault on and then off again. Filevault would not enable, so the first part of that sequence can’t be completed.打开 FileVault，然后再次关闭。 Filevault 将无法启用，因此该序列的第一部分无法完成。

3. Use the MacOS Setup Assistant to create a new admin account by deleting /var/db/.AppleSetupDone                                                             This was the first thing I tried, but the resulting admin account either didn’t generate the token or could not set it to On as it should have.使用 MacOS 设置助手通过删除 /var/db/.AppleSetupDone 创建新的管理员帐户这是我尝试的第一件事，但生成的管理员帐户要么没有生成令牌，要么无法将其设置为应有的状态有。

After all three of those failed, since I didn't need anything on the MBP's internal SSD, just get it deployable, I booted into Recovery, deleted the Boot volume, created a new Boot volume, and installed Monterrey into the new APFS volume. This apparently corrected whatever was at fault in BridgeOS, as the 501 admin account was recognized by the Startup Security Utility as an admin, and FileVault could be enabled normally.在这三个都失败之后，由于我不需要 MBP 内部 SSD 上的任何内容，只需将其部署即可，我启动进入恢复，删除启动卷，创建一个新的启动卷，并将 Monterrey 安装到新的 APFS 卷中。这显然纠正了 BridgeOS 中的任何错误，因为启动安全实用程序将 501 管理员帐户识别为管理员，并且可以正常启用 FileVault。