2

Afternoons all,

So I have a MacBook Pro, 2018 TB with High Sierra that's bound to a Windows domain, built via JAMF.

We have one admin account on the machine which our IT team use then the user account where they themselves are also admins. I should point out I have admin rights on the machine.

Nothing special about these accounts as far as I'm aware.

However when my user logs onto the machine, to do their work and then reboots, at logon they are only prompted for the password for the IT admin account. They don't see the username and password fields.

I'm trying to go through the console logs but unsure what I'm even looking for.

I should have mentioned, I have admin rights but some features are locked down via JAMF security profiles.

Anyone else seen this issue?

Improve this question
1
  • I would guess your IT team have made a mistake. First thing to do is report the problem to them.
    – mmmmmm
    Oct 26, 2018 at 16:10

4 Answers 4

Reset to default
3

go to setting > security and privacy > FileVault. There should be a notice saying that some users are not allowed to unlock the Vault, with an option to change the setting. You have to have admin privileges to change the setting.

Improve this answer
1

FileVault is the clear case where the system will boot to a pre-OS screen and show you only the file vault enabled accounts. When you sign in and authenticate as one of these accounts, that unlocks a decryption key that allows the OS to be readable and starts the actual OS boot process.

You can determine which accounts have been enabled in FileVault by examining that system preference once you’re logged in to the running OS.

Since you managed MDM and JAMF - here is an article with great technical data on the need for a secure token to be provisioned for each FileVault enabled account:

Your IT team should investigate JAMF Connect which extends the typical log in screen to let any AD allowed account log in. It also can be provisioned so that membership in an AD group maps to an admin local account or a non-admin local account. It’s an amazing tool and far better than binding which can have many down sides.

Improve this answer
1
  • Cheers for that bud, confirmed that the user does have securetoken. I have enabled under FV2 to allow this user to unlock the machine but still a no go after a reboot or from shutdown. Will mention Connect though to the teams.
    – nullHip_nullSquare
    Nov 1, 2018 at 16:02
0

Since you have Admin privileges, open users and groups > Log in Options > Log in and set it to show List of users.

enter image description here

Improve this answer
3
  • Auto login has been disabled by the upper echelon of my company but thanks for that bud
    – nullHip_nullSquare
    Nov 1, 2018 at 13:18
  • can you access this screen or not ? I did not say to change Auto Login, I said just change the Display login widow as: It is unclear to me if you have admin rights or not.
    – Ruskes
    Nov 1, 2018 at 15:40
  • I should have mentioned, I have admin rights but some features are locked down via JAMF security profiles.
    – nullHip_nullSquare
    Nov 1, 2018 at 15:53
-1

I've just bound a MacBook Pro to a domain (for the first time), and have apparently had the same (painful !) issue. FireVault wasn't the culprit, because it isn't enabled by default.

The solution (inspired by this thread) was to enable "mobile accounts" in the domain binding menu:

screenshot of domain binding menu with circled option macOS Big Sur (11.2.3), en français

Improve this answer
1
  • My answer solved the problem (as I understand it) for me. Would someone like to explain the downvote ?
    – pb8330
    May 9, 2021 at 14:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .