33

When I first setup my OSX laptop, my filevault and user login password were the same. At bootup, I only had to login once (with my username and password).

I recently changed my OSX password but my filevault / disk encryption password was not changed. Now I have to login twice when I boot up (first with my old pass, then with the new one).

Is there any way to change the disk encryption password so I can be in sync with my login password?

I tried Disk Util > File > Change Password, but it is greyed out.

Improve this question

4 Answers 4

Reset to default
25

Just bumped into this issue too, if you change password via

Settings > Users & Groups > Change Password ...

you will be prompted twice, once for the File Vault original password and again for the new account password. However if you change the password via

Settings > Security & Privacy > Change Password ...

both will be updated, noting that you will be required to enter the account password not the File Vault original password, so you can reset the File Vault password by entering your new password three times.

Improve this answer
3
  • This worked for me, without having to add/remove users (only had one)
    – Andrei Fierbinteanu
    Commented Sep 5, 2015 at 21:08
  • This only works for the computer you're working on, if you have multiple computers and using it via network/mobile-accounts (thus using a network account server). For fixing the other computers, see the answer below.
    – doekman
    Commented Feb 13, 2019 at 15:54
  • Does this decrypt and re-encrypt everything on disk?
    – Petrus Theron
    Commented Sep 28, 2020 at 15:33
13

It is supposed to be automatic, however I have encountered this during the Yosemite upgrade. I'll explain how I fixed it.

For the sake of discussion, I'll use AUserName to refer to the user whose password is out of sync.

Generally speaking it's quite simple. Remove AUserName from the list of users that can unlock this disk, then add them back.

IMPORTANT, if you do not have multiple users who can unlock the disk, add one now, or have the recovery key handy.

Here's what you do:

  • Click the Finder icon in the Dock
  • Click Applications
  • Double click Utilities
  • Double click Terminal

  • In the terminal window, type the following:

    sudo fdesetup remove -user AUserName

    You'll be prompted to enter your password.

    This removes AUserName from the list of unlock users. Next,

  • Click the Preferences icon in the Dock
  • Click the Security icon in preferences
  • Click the FileVault tab
    There should be a warning message that "Some users are not able to unlock the disk"
  • Click the "Lock" icon at the bottom of the window and supply administrator credentials.
  • Click the Enable Users button
  • Click the Enable User next to AUserName
  • Click Done
Improve this answer
4
  • I did this, but now AUserName is not listed anymore on the pre-boot login screen. I logged in as the other user, and fiddled a bit with the settings of the User & Groups preference pane, and now my AUserName appearas again in the screen.
    – doekman
    Commented Feb 13, 2019 at 15:52
  • This is a bad thing to do if your user is the only one. You will end up in a filevault drive without a user to unlock. If you end up in such situation, the way to solve is to unlock the drive from the recovery mode using filevault recovery key in disk utility, then run terminal and run resetFileVaultpassword utility. This way you will get your user inserted back. But many thing will reset to default in macOS. Note that resetFileVaultpassword also works without unlocking the drive first but then it will not insert the user. So be extra careful with removing user with fdesetup.
    – User366
    Commented Aug 19, 2019 at 11:49
  • 1
    You can check existing filevalut users with "sudo fdesetup list --extended".
    – User366
    Commented Aug 19, 2019 at 11:52
  • @Dmitri Yes, you should always have one properly synchronized user id. Even if it means creating a new user just to fulfill that role. Any time you work with any form of access controls, you make sure you have a way back in. Thankfully, I've not had an issue since that upgrade to Yosemite.
    – Devon_C_Miller
    Commented Aug 29, 2019 at 20:12
3

I had similar problem. And didn't even know that was a problem. I thought it is standard to have one pass to unlock disk and another to login to the system. As to why during unlock there was unknown username and avatar I thought it was a bug which appeared after one of the osx major updates.

It turned out that my main admin user was not authorized to unlock the disk and some random/legacy user I created for test a year ago was authorized. So I went to System Preferences->Security&Privacy->FileVault and authorized my main user to unlock.

Strange is that when I went to Users&Groups to delete that random user it was not not on the list like it haven't existed (this is one of reasons that I thought before that everything is ok). So I created a user with the same name and only then could delete it.

Now I can unlock disk and login with just one user and enter password just once.

Improve this answer
0

You could also use sudo fdesetup sync

Improve this answer
4
  • This command is not supported on APFS volumes?
    – Cameron
    Commented Jan 11, 2019 at 18:08
  • 2
    This doesn't work on APFS and didn't do anything useful in this context. From the man-page: "The sync command synchronizes Open Directory attributes (e.g. user pictures) with appropriate FileVault users, and removes FileVault users that were removed from Open Directory. In most cases these changes will already be updated in FileVault. sync does not add users to FileVault."
    – doekman
    Commented Feb 13, 2019 at 15:57
  • Where in the question did you see he was referring to APFS volumes?
    – Maximus
    Commented Feb 22, 2019 at 8:42
  • Maximus, I guess doekman answered a question from cameronroe.
    – User366
    Commented Oct 15, 2019 at 8:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .