Description
Sometimes when a user changes their password without utilizing an Apple or Jamf designed method, their local computer password syncs but fails to sync the new password to their FileVault password.
This can happen in multiple ways, two examples are:
User called helpdesk and password was changed by them via Active Directory.
User went to IdP URL and changed password there.
In both situations the password is updated for the user's account, but without something like Jamf Connect, the password is not updated for FileVault. This becomes an issue when encrypted computers are restarted and the user is advised their password is incorrect.
To get the user logged in to their account, we can use a second account that is enabled as a Secure Token user to run fdesetup commands to remove and re-add the user for FileVault.
Using fdesetup to Remove/Add a User for FileVault
Log in to a secondary account on the computer that has a secure token and known password.
Open Terminal and run the command below to get a list of FileVault enabled users, the affected username should display, make note of it for the next step.
fdesetup list -verbose
Run the command below to remove the affected user from FileVault.
fdesetup remove -user affectedusername
Run the command below to re-add the previously removed user.
fdesetup add -usertoadd affectedusername
Terminal will now prompt for a username, it is requesting an authorized admin for
fdesetup. Put in the username of the secondary account you logged in with and the password when prompted.Terminal will now prompt for the affectedusername's password, enter in their current password.
A success message will be displayed when complete.
Restart the computer and attempt to login with the affectedusername.
More Resources
For a full list of commands for fdesetup, run man fdesetup in Terminal.