Afternoons all,

So I have a MacBook Pro, 2018 TB with High Sierra that's bound to a Windows domain, built via JAMF.

We have one admin account on the machine which our IT team use then the user account where they themselves are also admins. I should point out I have admin rights on the machine.

Nothing special about these accounts as far as I'm aware.

However when my user logs onto the machine, to do their work and then reboots, at logon they are only prompted for the password for the IT admin account. They don't see the username and password fields.

I'm trying to go through the console logs but unsure what I'm even looking for.

I should have mentioned, I have admin rights but some features are locked down via JAMF security profiles.

Anyone else seen this issue?

  • I would guess your IT team have made a mistake. First thing to do is report the problem to them. – user151019 Oct 26 '18 at 16:10

FileVault is the clear case where the system will boot to a pre-OS screen and show you only the file vault enabled accounts. When you sign in and authenticate as one of these accounts, that unlocks a decryption key that allows the OS to be readable and starts the actual OS boot process.

You can determine which accounts have been enabled in FileVault by examining that system preference once you’re logged in to the running OS.

Since you managed MDM and JAMF - here is an article with great technical data on the need for a secure token to be provisioned for each FileVault enabled account:

Your IT team should investigate JAMF Connect which extends the typical log in screen to let any AD allowed account log in. It also can be provisioned so that membership in an AD group maps to an admin local account or a non-admin local account. It’s an amazing tool and far better than binding which can have many down sides.

  • Cheers for that bud, confirmed that the user does have securetoken. I have enabled under FV2 to allow this user to unlock the machine but still a no go after a reboot or from shutdown. Will mention Connect though to the teams. – nullHip_nullSquare Nov 1 '18 at 16:02

go to setting > security and privacy > FileVault. There should be a notice saying that some users are not allowed to unlock the Vault, with an option to change the setting. You have to have admin privileges to change the setting.


Since you have Admin privileges, open users and groups > Log in Options > Log in and set it to show List of users.

enter image description here

  • Auto login has been disabled by the upper echelon of my company but thanks for that bud – nullHip_nullSquare Nov 1 '18 at 13:18
  • can you access this screen or not ? I did not say to change Auto Login, I said just change the Display login widow as: It is unclear to me if you have admin rights or not. – Ruskes Nov 1 '18 at 15:40
  • I should have mentioned, I have admin rights but some features are locked down via JAMF security profiles. – nullHip_nullSquare Nov 1 '18 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .