I've started a new position where I manage a number of macbooks running High Sierra and Mojave with Filevault enabled. We've got mobile/network accounts on them that are connected to Active Directory. We use Lanrev to manage them.

When people update their active directory passwords, the changes aren't propagating to the macs unless they're connected to ethernet at the time of the change - this is normal and typically users can log in with their old passwords. Most changes propagate in a couple of hours via wifi, but some don't. If I run mcxrefresh on the account the users are able to login with their new passwords - if they're prompted for both their username and password at login. However, if they instead select their account on the login screen from the list of accounts, they're unable to log in at all.

Interestingly, I've noticed the same thing occurs for local accounts - if I change a local account's password, I'm only able to log in when entering in its username and password, but not when selecting it from a list of users.

I suspect this has something to do with filevault, but I'm not sure. If I can provide any more information, please let me know. We have workarounds in place but this is more of a curiosity at this point.

Tl;dr: both mobile and local user accounts aren't able to log in after changing their passwords if the account is selected from a list of users. They are able to log in if they enter both their username and password. Why?

  • 1
    When you talk about entering username vs selecting it from a list, does this correspond to the pre-boot authentication screen (which appears after a reboot, before the first user logs in) vs the login screen (which appears after at least one user has logged in & back out)? – Gordon Davisson Aug 17 '19 at 5:26
  • Hi, I'm referring to the login screen - I wasn't aware that the other screen was called the pre-boot authentication screen. – GeoGeoGeometry Aug 19 '19 at 18:14

You must log in to answer this question.

Browse other questions tagged .