Help! Lost admin password for Mac OS X server 10.9

Question

While our netwrokd administrator was admitted to a hospital for an emergency surgery (he is now in coma), being as a temporary delegate, I was ordered by our Institution to turn OFF Mail funciton and to change the admin account password for Mac OS X Server 10.9.2 for security reasons. While changing the password, I took a memo for the new password, but later it turned out to be wrong! My stupidity.

After restart, I cannot open Server.app that controls Mail service because it requires the unknown new password.

Currently Mail service is OFF (it had been turned OFF for security reason before password change), but I' going to need to turn it ON soon after the order is lifted. To do that, however, I need the new password. Luckily, the server still provides access to the Internet. Thus I can still ask you.

Thanks to the following instruction, I find a way to reset the admin password. http://fixedbyvonnie.com/2013/09/how-to-reset-the-admin-password-on-your-mac-without-a-disk/#.Uz5eM8cT-pe

I carried out a test of the same procedure on another Mac (10.9.2). In the test, although resetpassword command in Recovery Mode successfully updated the account password, it didn't update default Keychain password at the same time.

After restart, the OS asks if I want to update 'default Kecyhain password'. To update it, I need to enter the older Keychain password that I don't know. If I skip the update, Keychain asks passwords repeatedly, and without the old Keychain password, I can't launch and open Keychain Access.

Then I found this. It says you can reset the Keychain password by Keychain First Aid. https://discussions.apple.com/message/24171670#24171670

However, in my test, Keychain First Aid still asks the older Keychain password, so this doesn't work.

In short, I can update the admin password, but not the Keychain password without knowing the old password. So if I carry out this on the server machine, The Server won't run properly and would ask passwords over and over again.

On the test Mac I tried to activate root user, hoping the root user could change Keychain password without knowing the old Keychain password. But I couldn't access to the "login" Keychain of the account in question from the root account.

Does anyone know a work-around?

Is there a way to reset the default Keychain password without the old Keychain password?

Or, is there a way to know the old Keychain password? Probably not.

Or, do you think TimeMachine can undo my failure in changing the admin password and recover the old admin password?

During this mail shutdown period, I assume many people have asked his health status by email. It's an emergency and I really need your help!

Answer 1

In conclusion, TimeMachine recovery of the entire system to the status before changing admin password worked well. I recovered the old admin password and it worked for Keychain Access as well.

In details; Just in case the recovery doesn't work and I lose the TimeMachine backups somehow, I copied the TimeMachine backup to another external drive. To do that, however, I needed admin password. So, first I had to reset the admin password.

Note: In my case, the destination for TimeMachine backup was a local partition (probably), so I didn't need network password to access it. If it were in network, for example, you would need password that has been lost at step 8. Then this procedure may not work for you. Before actually try the following steps, it may be good to see if you need password for system recovery, following http://support.apple.com/kb/PH14185 (step 5 in this page is the key), but just cancel when you are asked to choose date and time.

1. Open the Time Machine pane in System Preferences. Choose Time Machine > Open Time Machine Preferences…

2. Slide the Time Machine switch to Off.

3. Restart the Mac with Command + R keys held down to enter Recovery Mode.

4. In Recovery Mode, launch Terminal.app.
5. In Terminal.app, type resetpassword.
6. Choose the admin account and set new password. Verify it.

7. Warning about Keychain will appear.

8. Restart. Now you get admin password at the cost of loosing Keychain password. The server won't work properly any longer.

9. The OS will ask if you want to update Keychain password. Because you don't know the old password. You can't do that. So just choose Continue in the middle.

10. The system will ask Keychain passwords, but you have to ignore them.

11. Connect an external drive that is large enough.

12. If necessary, reformat the drive to Mac OS Extended (Journaled). see http://support.apple.com/kb/ht5096
13. Click the icon of the new backup drive and choose Get Info from the File menu or press Command-I (⌘-I)
14. Make sure Ignore ownership on this volume at the bottom of the Sharing & Permissions: section is not checked.
15. Open a new Finder window. In the Finder sidebar, click the icon of the current backup drive.
16. Open a new Finder window. In the Finder sidebar, click the icon of the new backup drive.
17. Drag the folder Backups.backupdb on the current backup drive to the root level of the new backup drive.
18. Enter an administrator name and password (you needed to reset the admin password for this step), then click OK to start the copying process. This may take some time to complete because all the backups will be copied.

19. After the copy has completed, you can eject the eternal drive.

20. Restart the machine with Command and R keys held down to enter Recovery Mode.

21. In Recovery Mode, Select Restore from a Time Machine Backup, then click Continue.
22. Select the TimeMachine storage.

23. Select the date and time of the backup you want to restore, then follow the onscreen instructions.

24. In my case, I successfully recovered admin password as well as default Keychain password.

Answer 2

Reset your keychain password by opening Keychain Access in Applications > Utilities. Select the login keychain from the left side and then go to the File menu and choose Delete Keychain “login”. When prompted, choose Delete References to allow the keychain file to stay on your hard drive for future re-activation.