2

I have a managed Mac from work running Sonoma 14.2. I believe our IT dept uses InTune to control the Mac. I recently changed my password, now I have to login twice when I restart. I have FileVault turned on.

  1. Login screen, use OLD password.
  2. Load progress bar takes 10 seconds
  3. Login screen reappears, must use NEW password.
  4. Finally logs into my user account.

I've tried changing my password. My IT dept had me try a bunch of things but now they've run out of ideas.

What's the issue here, and how can I use my new password alone to log into the Mac?

6
  • 4
    Having been an actual IT department, throwing up your hands and saying you don't know how to fix something would not bode well for the IT department. They need to figure this out even if it means good old fashioned hard work and maybe even calling tech support at InTune. I'd be tempted to insist they fix it. Failing that a trip up the management ladder might be called for. Commented Dec 18, 2023 at 15:41
  • 4
    That sounds like your Mac is bound to AD but does not have anything in place to sync your AD password with the local Mac password, such as the Kerberos SSO extension or NoMAD. Note to your IT Dept.: managing Macs is not the same as managing Windows.
    – da4
    Commented Dec 18, 2023 at 15:59
  • 2
    The pragmatic thing to change would to be get their permission to temporarily unmanage your device and see if a second password change gets things re-synced on the OS client side. I'll put a formal answer, there's really a lot that could be going on here and single sign on may not be in the cards based on their decisions. Are you the only Mac user you work with? Are they stuck if they change a password in similar situation?
    – bmike
    Commented Dec 18, 2023 at 16:23
  • There are other Macs on campus. I'm fully WFH so IT will remote into my machine. I first updated my password "incorrectly", i.e. not on the corporate VPN to allow it to sync. They had me do it again correctly and it seems to work. But nothing seems to affect the 1st password prompt. Commented Dec 18, 2023 at 17:17
  • Good details @projectshave - does your IT manage bootstrap tokens and such? support.apple.com/guide/deployment/… That’s when things started to get forked on the managed side with 10.14 or so… hopefully the decisions they made alllowmyou to change password smoothly as WFH. Not all setups work that way…
    – bmike
    Commented Dec 18, 2023 at 18:34

2 Answers 2

3

We can't begin to guess how your work is setting up the security settings. You don't mention if your password comes from a cloud source or is just local to the Mac.

IT can inject custom code and scripts on your Mac and/or programs to help synchronize passwords, it could be you broke (or they broke) the link between the user password, the keychain password and the pre-boot FileVault password.

They could be trying to escrow a FileVault token with MDM, they could be running scripts and home designed software, they may have incorrectly configured Intune.

Your path forward is to document the issues this is causing you and work to help them understand the impact and then be as gracious as you can be while they marshall whatever resources they need to help the front line staff that tried some things and may or may not have even documented the triage steps they attempted with you.

To fix this - someone will need to know and consider the exact hardware you have, the exact customizations, arrange time to work with you and train / review process. Then they need to consider the design of Apple side and consider all the Intune settings and any modifications / management profiles that have been pushed to your device. Then they have to design some tests to confirm what happened, then they need to arrange a plan to fix your issue and update their tooling and processes and documentation or to inform you they made a decision to make your life a little more complicated and this is the intended implementation.

Keeping passwords synced generally exposes you to security risks unless it's done with diligent research, care, coding and decisions. An IT department can optimize for their ease of support or your ease of use and often those goals are at conflict and they compromise one or both parties in their decisions to implement security practice.

Good luck!

2
  • The IT setup is likely Jamf for Mac. The password is changed on IT website, which filters through many corporate services. I sent them this link, which seems to describe my problem well. (community.jamf.com/t5/jamf-pro/…) But I can't do this without their blessing, as I'm likely to hose my system. :-) Commented Dec 18, 2023 at 19:58
  • Excellent news @projectshave the pro version of Jamf MDM is very powerful and customizable and their support for your IT team to leverage will be excellent if they can’t self diagnose and fix it themselves. The secure token is far more useful for them than the bootstrap token I mentioned. Please don’t hesitate to make your own answer or edit mine once you have a fix. Your case might be very quick to solve knowing some decisions IT made and looking at jamf setups in the MDM side.
    – bmike
    Commented Dec 18, 2023 at 20:03
1

After speaking to many tech support folks, one finally solved the problem. He simply removed and re-added my account to the FileVault service. That's it.

sudo fdesetup remove -user theuser
sudo fdesetup add -user theuser

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .