7

My Mac at work is bound to our Active Directory domain. It's managed with JAMF, and I have NoMAD installed.

The last time I came due for a password change (every sixty days), an unknown issue prevented me from executing the change from my Mac. Our IT folks couldn't figure out the issue, so I was forced to do my AD password change from a Windows PC elsewhere on the network. This left my Mac's login password, as well as my Keychain and Filevault passwords, the same as before.

As I understand it, NoMAD was supposed to detect that they were out of sync and automatically fix it for me, but that hasn't happened. I have not been able to determine why.

Our IT folks are Windows guys. One of them knows the Mac reasonably well, but he's not an expert in this area and he's stumped.

This was all 56 days ago, so I'm about due to change my password again. I tried to do it in System Preferences -> Users & Groups, which is my normal method, but it fails with the same mysterious error I got last time -- it says the server is not available.

error message showing server unavailable

As far as I can tell, the server is available. But this isn't the point.

When that failed, I tried changing with NoMAD, but I can't. The error message is the generic "local password doesn't meet policy requirements", and I assume it's because my local password isn't the same as the one in AD, so when it tries to confirm my old password, it can only succeed for one of the two backing systems. I've tried both old passwords; same error.

So, my question: What, if anything, can I do to update my Mac's local, keychain, and Filevault passwords that will not try to update AD?

Things I've tried:

  1. Users & Groups sysprefpane, as described above
  2. Changing with NoMAD, as described above

  3. Using passwd at the terminal. Same results for both old passwords:

    % ~ passwd
Changing password for jrobb.
Old Password:
New Password:
Retype New Password:
passwd: general failure

  4. Repeat #1 while disconnected from the network. Same "server is not available" message -- and this time I believe it!

  5. Repeat #2 while disconnected from the network. Same "local password doesn't meet policy requirements" as before.

If it matters, I'm running 10.14.6.

UPDATE: After unbinding and re-binding my Mac to the AD domain, my Mac's password was sync'd up with AD. But then I encountered the same "server is not available" error when trying to change the password from Users & Groups, forcing me to use another method to update my AD password, and now they're out of sync again. 😭

Improve this question
5
  • 4
    It might be a good time to remind your IT department it's no longer advised to force users to change passwords periodically. UK & US governments advise against it & even Microsoft no longer endorse it ;)
    – Tetsujin
    Commented Aug 12, 2019 at 15:59
  • Oh, I know. Big company, slow moving, with even bigger, slower moving customers. We are obligated by contract with several of those customer to follow crummy old “best practices,” so it’s going to be a while before anything changes. Fun, right? 🤦🏻‍♂️
    – JakeRobb
    Commented Aug 13, 2019 at 3:33
  • @Tetsujin, for the sake of playing devil's advocate, here's a discussion I had with one of my university's sysadmins; they enforce password changes every 90 days. I'd be interested to know if anyone has any counterpoints to his (which are honestly quite reasonable, IMO).
    – Jivan Pal
    Commented Aug 10, 2020 at 14:10
  • 1
    "virtually all passwords are stolen through phishing" Citations please ;) personally, my main argument for never changing unless discovered compromised is best seen by taking a walk round an ordinary office - just see how many are written on post-its on the screen..often with the changes scribbled out each time 'fred12' fred34' The 'smarter' workers… you'd need to get their filofax out of their drawer ;) tbh, these days, especially on Macs, having all these massively complex passwords, different for every account & all synced securely in Keychain puts paid to most of the arguments either way.
    – Tetsujin
    Commented Aug 10, 2020 at 14:23
  • I'd also point them to the official links I posted above, rather than some magazine's take on that advice. That way, they can't cast aspersions on the integrity of the info source. "Your government's national security service recommends this" has greater force than "The Daily Mail says.." ;))
    – Tetsujin
    Commented Aug 10, 2020 at 14:26

2 Answers 2

Reset to default
4

As I understand it, the correct way to change domain passwords should be kpasswd, which should update both local computer and domain passwords.

Note that I'm not in a position to test this right now, but something like:

> kpasswd [email protected]
[email protected]'s Password: 
New password for [email protected]: 
Verify password - New password for [email protected]: 
Success

I'll try and test this out and update this post.

Improve this answer
4
  • This checks out - maybe sprinkle in a klist to check status and kinit to be sure the domain is properly connected before changing the PW. NoMad is supposed to handle this sync for you in most configurations, so it might just be “breakage” not, design or steps are wrong here from the OP perspective
    – bmike ♦
    Commented Aug 10, 2020 at 7:20
  • You mean klist?
    – Endareth
    Commented Aug 11, 2020 at 0:13
  • 🤦🏼‍♂️ yes indeed
    – bmike ♦
    Commented Aug 11, 2020 at 1:11
  • I don't work at that place anymore, but this answer seems useful and it's the only one I have, so you get a green check mark!
    – JakeRobb
    Commented Sep 15, 2022 at 21:25
0

As noted in the comments on another answer, I no longer work there (or anywhere using ActiveDirectory), so I'm unable to verify this solution.

However, I just came across this article, which addresses a similar situation wherein the network password and the Filevault password get out of sync. It could be useful here as well. In particular, it suggests leaving the Mac powered on at the login screen for 15-30 minutes in order for syncing to occur. I don't believe I ever tried that.

https://community.jamf.com/t5/jamf-pro/a-reliable-fix-for-filevault-2-password-sync-issue/m-p/234241

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .