`sudo passwd` asking for old password / reset recovery key

Question

I'm an admin on my Mac (macOS Montrey 12.5), but forgot my own password.

I can login remotely from another machine (SSH key based auth), and I have sudo configured with NOPASSWD for the admin group. So I'm able to run any sudo command; however, I cannot change my own password!

passwd asks for the old password (!), and dscl / sysadminctl didn't seem to work either. I tried:

$ sudo passwd me
Changing password for me.
Old password:

$ sudo sysadminctl -resetPasswordFor me -newPassword passw0rd
2022-08-01 12:00:00.000 sysadminctl[6735:297889] Operation is not permitted without secure token unlock.

$ sudo dscl . -passwd /Users/me
New Password:
Permission denied. Please enter user's old password:

I also tried running the above commands as root by doing sudo zsh first. But got the same results.

When I boot into Recovery Mode (Command-R while booting), I select Forgot all password? it prompts for:

Enter your recovery key to unlock the volume "Macintosh HD"

(I'm certain I've setup macOS with FaileVault off, but it seems one of the OS upgrades enabled it for me.)

Attempting to turn off File Vault still prompts for the admin user password:

$ sudo /usr/bin/fdesetup disable
Enter the user name:me
Enter the password for user 'me':
FileVault was not disabled (11).

When I boot into Single User Mode (Command-S while booting), macOS Montrey now enters into a GUI screen and prompts for the password. (I guess due to FileVaule?)

Is it possible to reset my password or regenerate a new Recovery Key from the command-line?

Your help is greatly appreciated.

Answer 1

I'm not sure if this counts as an "answer", but I managed to turn off FileVault! Despite the error:

Operation was denied because the current credentials do not have the appropriate privileges.

$ sudo /usr/bin/fdesetup disable
Enter the user name:notadmin
Enter the password for user 'notadmin':
2022-08-08 10:00:00.000 fdesetup[650:5380] set accountPolicies error :Error Domain=com.apple.OpenDirectory Code=4001 "Operation was denied because the current credentials do not have the appropriate privileges." UserInfo={NSLocalizedDescription=Operation was denied because the current credentials do not have the appropriate privileges., NSLocalizedFailureReason=Operation was denied because the current credentials do not have the appropriate privileges.}
FileVault has been disabled.

$ sudo /usr/bin/fdesetup disable
FileVault is already Off.

After that, I booted into Recovery Mode (Command-R while booting), opened a terminal and typed:

resetpassword

I select Forgot all password? and it forced me to change the password of every single user on the Mac.

I rebooted the machine, and was able to login using the newly reset password.