3

My Mac at work is bound to our Active Directory domain. It's managed with JAMF, and I have NoMAD installed.

The last time I came due for a password change (every sixty days), an unknown issue prevented me from executing the change from my Mac. Our IT folks couldn't figure out the issue, so I was forced to do my AD password change from a Windows PC elsewhere on the network. This left my Mac's login password, as well as my Keychain and Filevault passwords, the same as before.

As I understand it, NoMAD was supposed to detect that they were out of sync and automatically fix it for me, but that hasn't happened. I have not been able to determine why.

Our IT folks are Windows guys. One of them knows the Mac reasonably well, but he's not an expert in this area and he's stumped.

This was all 56 days ago, so I'm about due to change my password again. I tried to do it in System Preferences -> Users & Groups, which is my normal method, but it fails with the same mysterious error I got last time -- it says the server is not available.

error message showing server unavailable

As far as I can tell, the server is available. But this isn't the point.

When that failed, I tried changing with NoMAD, but I can't. The error message is the generic "local password doesn't meet policy requirements", and I assume it's because my local password isn't the same as the one in AD, so when it tries to confirm my old password, it can only succeed for one of the two backing systems. I've tried both old passwords; same error.

So, my question: What, if anything, can I do to update my Mac's local, keychain, and Filevault passwords that will not try to update AD?

Things I've tried:

  1. Users & Groups sysprefpane, as described above
  2. Changing with NoMAD, as described above
  3. Using passwd at the terminal. Same results for both old passwords:

    % ~ passwd
    Changing password for jrobb.
    Old Password:
    New Password:
    Retype New Password:
    passwd: general failure
    
  4. Repeat #1 while disconnected from the network. Same "server is not available" message -- and this time I believe it!

  5. Repeat #2 while disconnected from the network. Same "local password doesn't meet policy requirements" as before.

If it matters, I'm running 10.14.6.

UPDATE: After unbinding and re-binding my Mac to the AD domain, my Mac's password was sync'd up with AD. But then I encountered the same "server is not available" error when trying to change the password from Users & Groups, forcing me to use another method to update my AD password, and now they're out of sync again. 😭

  • 1
    It might be a good time to remind your IT department it's no longer advised to force users to change passwords periodically. UK & US governments advise against it & even Microsoft no longer endorse it ;) – Tetsujin Aug 12 '19 at 15:59
  • Oh, I know. Big company, slow moving, with even bigger, slower moving customers. We are obligated by contract with several of those customer to follow crummy old “best practices,” so it’s going to be a while before anything changes. Fun, right? 🤦🏻‍♂️ – JakeRobb Aug 13 '19 at 3:33
  • @Tetsujin, for the sake of playing devil's advocate, here's a discussion I had with one of my university's sysadmins; they enforce password changes every 90 days. I'd be interested to know if anyone has any counterpoints to his (which are honestly quite reasonable, IMO). – Jivan Pal Aug 10 at 14:10
  • "virtually all passwords are stolen through phishing" Citations please ;) personally, my main argument for never changing unless discovered compromised is best seen by taking a walk round an ordinary office - just see how many are written on post-its on the screen..often with the changes scribbled out each time 'fred12' fred34' The 'smarter' workers… you'd need to get their filofax out of their drawer ;) tbh, these days, especially on Macs, having all these massively complex passwords, different for every account & all synced securely in Keychain puts paid to most of the arguments either way. – Tetsujin Aug 10 at 14:23
  • I'd also point them to the official links I posted above, rather than some magazine's take on that advice. That way, they can't cast aspersions on the integrity of the info source. "Your government's national security service recommends this" has greater force than "The Daily Mail says.." ;)) – Tetsujin Aug 10 at 14:26
1

As I understand it, the correct way to change domain passwords should be kpasswd, which should update both local computer and domain passwords.

Note that I'm not in a position to test this right now, but something like:

> kpasswd myusername@FULLADDOMAIN.COM
myusername@FULLADDOMAIN.COM's Password: 
New password for myusername@FULLADDOMAIN.COM: 
Verify password - New password for myusername@FULLADDOMAIN.COM: 
Success

I'll try and test this out and update this post.

| improve this answer | |
  • This checks out - maybe sprinkle in a klist to check status and kinit to be sure the domain is properly connected before changing the PW. NoMad is supposed to handle this sync for you in most configurations, so it might just be “breakage” not, design or steps are wrong here from the OP perspective – bmike Aug 10 at 7:20
  • You mean klist? – Endareth Aug 11 at 0:13
  • 🤦🏼‍♂️ yes indeed – bmike Aug 11 at 1:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .