0

I'm an admin on my Mac (macOS Montrey 12.5), but forgot my own password.

I can login remotely from another machine (SSH key based auth), and I have sudo configured with NOPASSWD for the admin group. So I'm able to run any sudo command; however, I cannot change my own password!

passwd asks for the old password (!), and dscl / sysadminctl didn't seem to work either. I tried:

$ sudo passwd me
Changing password for me.
Old password:

$ sudo sysadminctl -resetPasswordFor me -newPassword passw0rd
2022-08-01 12:00:00.000 sysadminctl[6735:297889] Operation is not permitted without secure token unlock.

$ sudo dscl . -passwd /Users/me
New Password:
Permission denied. Please enter user's old password:

I also tried running the above commands as root by doing sudo zsh first. But got the same results.

When I boot into Recovery Mode (Command-R while booting), I select Forgot all password? it prompts for:

Enter your recovery key to unlock the volume "Macintosh HD"

(I'm certain I've setup macOS with FaileVault off, but it seems one of the OS upgrades enabled it for me.)

Attempting to turn off File Vault still prompts for the admin user password:

$ sudo /usr/bin/fdesetup disable
Enter the user name:me
Enter the password for user 'me':
FileVault was not disabled (11).

When I boot into Single User Mode (Command-S while booting), macOS Montrey now enters into a GUI screen and prompts for the password. (I guess due to FileVaule?)

Is it possible to reset my password or regenerate a new Recovery Key from the command-line?

Your help is greatly appreciated.

1
  • 1
    This article may help you. May be quite old but you may find some interesting tips
    – Ptit Xav
    Commented Aug 5, 2022 at 16:34

1 Answer 1

-2

I'm not sure if this counts as an "answer", but I managed to turn off FileVault! Despite the error:

Operation was denied because the current credentials do not have the appropriate privileges.
$ sudo /usr/bin/fdesetup disable
Enter the user name:notadmin
Enter the password for user 'notadmin':
2022-08-08 10:00:00.000 fdesetup[650:5380] set accountPolicies error :Error Domain=com.apple.OpenDirectory Code=4001 "Operation was denied because the current credentials do not have the appropriate privileges." UserInfo={NSLocalizedDescription=Operation was denied because the current credentials do not have the appropriate privileges., NSLocalizedFailureReason=Operation was denied because the current credentials do not have the appropriate privileges.}
FileVault has been disabled.

$ sudo /usr/bin/fdesetup disable
FileVault is already Off.

After that, I booted into Recovery Mode (Command-R while booting), opened a terminal and typed:

resetpassword

I select Forgot all password? and it forced me to change the password of every single user on the Mac.

I rebooted the machine, and was able to login using the newly reset password.

1
  • Nice. I was going to suggest making a time machine backup to a disk that’s not encrypted (or is with a pass phrase you know) and then erase + install.
    – bmike
    Commented Aug 10, 2022 at 8:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .