3

How do I change a user's password without the old one, via the command line, on macOS Catalina beta? sudo dscl . -passwd /Users/abc password used to work before Catalina, but asks for the old password now.
Are there any alternatives that can be used?

1

You'll have to reboot the Mac in recovery mode, open a terminal, the issue the command "resetpassword". You will have to reset the password for every account on the system or it won't let you proceed.

The really horrible thing about this new Apple "security measure" is that it allows malware authors to create accounts on your computer that you can't delete unless you know the procedure I outlined in the above.

Followup:

The reason for this is because the account that you want to reset the password for has a Secure Token set. If the account was created at the GUI level or at the command line using "sysadminctl", and was created as an admin account, then it most definitely has a Secure Token set.

Followup #2:

Not all Macs will have the SecureToken enabled on all accounts, this is usually the case where the Mac originally came with some version of Mac OS prior to Catalina. No, root doesn't even have this token enabled. However, the SecureToken capability has been around since High Sierra and was set any time that Migration Assistant was used or if FileVault was ever enabled. If a Mac was upgraded to Catalina, the user who ran the upgrade will get the SecureToken set on their account even if somebody else has it too. Those users will be the only ones who can grant the token to other users or revoke it and this has to be done at the command line with sysadminctl, you will also need to know the password to any account that you intend to modify. As of Catalina, if you forget the password to any account with the SecureToken enabled, no other users can reset that account password unless you know the current password. In which case, you will have to reboot the Mac into recovery mode and reset the passwords for all user accounts. Thanks Apple! (NOT)

4
  • Deleting a user account is something any admin user can do, without knowing the password of the user. So I‘m not sure whether the concern raised in your second paragraph is actually valid. – nohillside Dec 25 '19 at 11:48
  • That only worked up until Catalina. – Larry Athey Dec 26 '19 at 20:45
  • Also, prior to Catalina, you could reset another user's password without knowing their current password. Many things have changed in Catalina because Apple thinks they're making things more secure by doing this. All they've actually done is allow malware writers to create user accounts that the owner can't delete unless they go into recovery mode and reset all passwords on the system first. – Larry Athey Dec 26 '19 at 22:02
  • @nohillside - Feel free to edit/correct this to your specifications if I didn't do this right, but here's your reference for my last comment. Just in case you're positive that what I'm saying couldn't possibly be right in the case of Catalina. link – Larry Athey Dec 27 '19 at 2:31
1

I tried using

sudo passed username

and was also asked for the old password for username. I was able to change username’s password by rebooting the computer, getting into the Users & Groups preference pane, unlocking it with the admin user ID and password, and clicking on the Change Password… button. No old password required.

The restart was the only way I knew to log out username. If username had not been logged in at the time, I would have been able to do this without a reboot.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .