Description
Ideally passwords should be changed from the Jamf Connect Menu Bar app (or Self Service+ for version 3.0 or later). If a password is changed directly in the Identity Provider and NOT synced with Jamf Connect, the previous password will still be the local account password on the computer.
If the old local password has been completely forgotten and cannot be provided at the Jamf Connect Login window for the password sync, we will need to use standard macOS workflows to regain access to the computer. The workflow differs depending on whether the machine is encrypted with FileVault.
Log in if FileVault is not Enabled
For computers that are not FileVault-encrypted, reset the user's local password with a Jamf Pro policy that leverages the Local Accounts payload.
This only works for user accounts that do not have a Secure Token.
In Jamf Pro, create a new policy by going to Computers > Policies > New.
Configure the General payload with:
a display name.
Set the trigger to "Recurring Checkin" and the frequency to "Once per computer."
Configure the Local Accounts payload.
Select the Reset Password button.
Enter the username and new password.
Click Scope and scope the policy to the affected computer.
Click Save.
After the policy runs, verify the user can log in with the new password.
Log in if FileVault is Enabled
For computers that are FileVault encrypted and the personal recovery key is known or escrowed in Jamf Pro, use the personal recovery key to reset the password.
Disable the Jamf Connect Login window in Terminal, via SSH, or via Jamf Pro policy by running the following command:
/usr/local/bin/authchanger -resetAfter Jamf Connect Login is disabled, reload the login window to bring up the native macOS screen.
Gather the FileVault key from Jamf and follow the steps in the following article to reset the password: https://support.apple.com/en-us/HT202860
If Jamf Connect is unable to be disabled through this process, you can also reset the authorization database in Recovery Mode which will default the Login Window to the native macOS screen. For more information see Editing the macOS loginwindow Application.