29

When I first setup my OSX laptop, my filevault and user login password were the same. At bootup, I only had to login once (with my username and password).

I recently changed my OSX password but my filevault / disk encryption password was not changed. Now I have to login twice when I boot up (first with my old pass, then with the new one).

Is there any way to change the disk encryption password so I can be in sync with my login password?

I tried Disk Util > File > Change Password, but it is greyed out.

19

Just bumped into this issue too, if you change password via

Settings > Users & Groups > Change Password ...

you will be prompted twice, once for the File Vault original password and again for the new account password. However if you change the password via

Settings > Security & Privacy > Change Password ...

both will be updated, noting that you will be required to enter the account password not the File Vault original password, so you can reset the File Vault password by entering your new password three times.

  • This worked for me, without having to add/remove users (only had one) – Andrei Fierbinteanu Sep 5 '15 at 21:08
  • This only works for the computer you're working on, if you have multiple computers and using it via network/mobile-accounts (thus using a network account server). For fixing the other computers, see the answer below. – doekman Feb 13 at 15:54
10

It is supposed to be automatic, however I have encountered this during the Yosemite upgrade. I'll explain how I fixed it.

For the sake of discussion, I'll use AUserName to refer to the user whose password is out of sync.

Generally speaking it's quite simple. Remove AUserName from the list of users that can unlock this disk, then add them back.

IMPORTANT, if you do not have multiple users who can unlock the disk, add one now, or have the recovery key handy.

Here's what you do:

  • Click the Finder icon in the Dock
  • Click Applications
  • Double click Utilities
  • Double click Terminal
  • In the terminal window, type the following:

    sudo fdesetup remove -user AUserName
    

    You'll be prompted to enter your password.

    This removes AUserName from the list of unlock users. Next,

  • Click the Preferences icon in the Dock
  • Click the Security icon in preferences
  • Click the FileVault tab
    There should be a warning message that "Some users are not able to unlock the disk"
  • Click the "Lock" icon at the bottom of the window and supply administrator credentials.
  • Click the Enable Users button
  • Click the Enable User next to AUserName
  • Click Done
  • I did this, but now AUserName is not listed anymore on the pre-boot login screen. I logged in as the other user, and fiddled a bit with the settings of the User & Groups preference pane, and now my AUserName appearas again in the screen. – doekman Feb 13 at 15:52
  • This is a bad thing to do if your user is the only one. You will end up in a filevault drive without a user to unlock. If you end up in such situation, the way to solve is to unlock the drive from the recovery mode using filevault recovery key in disk utility, then run terminal and run resetFileVaultpassword utility. This way you will get your user inserted back. But many thing will reset to default in macOS. Note that resetFileVaultpassword also works without unlocking the drive first but then it will not insert the user. So be extra careful with removing user with fdesetup. – Dmitri Aug 19 at 11:49
  • You can check existing filevalut users with "sudo fdesetup list --extended". – Dmitri Aug 19 at 11:52
3

I had similar problem. And didn't even know that was a problem. I thought it is standard to have one pass to unlock disk and another to login to the system. As to why during unlock there was unknown username and avatar I thought it was a bug which appeared after one of the osx major updates.

It turned out that my main admin user was not authorized to unlock the disk and some random/legacy user I created for test a year ago was authorized. So I went to System Preferences->Security&Privacy->FileVault and authorized my main user to unlock.

Strange is that when I went to Users&Groups to delete that random user it was not not on the list like it haven't existed (this is one of reasons that I thought before that everything is ok). So I created a user with the same name and only then could delete it.

Now I can unlock disk and login with just one user and enter password just once.

0

You could also use sudo fdesetup sync

  • This command is not supported on APFS volumes? – cameronroe Jan 11 at 18:08
  • This doesn't work on APFS and didn't do anything useful in this context. From the man-page: "The sync command synchronizes Open Directory attributes (e.g. user pictures) with appropriate FileVault users, and removes FileVault users that were removed from Open Directory. In most cases these changes will already be updated in FileVault. sync does not add users to FileVault." – doekman Feb 13 at 15:57
  • Where in the question did you see he was referring to APFS volumes? – Maximus Feb 22 at 8:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .