I'm getting the same messages as you are. "This command is not supported on APFS volumes."
I would also be interested in how to do it with APFS.
(We only have local Admin Accounts and none AD Accounts)

Thanks :)

This should be fixed on 10.13.3 and will not sync properly once the machine can connect with ad and the user has logged in with the new password.

I am having the same issue. Changed password restart or logout. I have to login first with old password then with AD Credentials

I have a tester Mac running 10.13.3 and it still takes days or weeks for the password to sync up.

For those searching around this topic, here are some more recent experiences/thoughts.

sudo diskutil apfs changePassphrase <your APFS volume, like: disk1s1> -user <the Disk User cryptographic UUID, like: 12345678-1234-1234-1234567890AB>

Will change the FV2 password, but requires you to know the users old password and their new one. I'm working on a Self Service Script to allow users to do this on their own as it has worked for us across the board when both passwords are known to the user.

We are using the following script for users to enable FV via Self Service, I found it on here from another member (sorry I don't remember who). It also works to update the FV password after an external AD password change.

#!/bin/sh

# This script is intended to be used with JAMF Self Service. It will enable SecureToken for the currently logged in user account

# and either add it to the list of to FileVault enabled users or enable FileVault using a Personal Recovery Key.



# Your policy must include script parameters for a SecureToken enabled administrator username and password. For more information

# on using script parameters, please see https://www.jamf.com/jamf-nation/articles/146/script-parameters.



adminUser="$4"

adminPassword="$5"

userName1="$3"

userName2="$6"



# Uses AppleScript to prompt the currently logged in user for their account password.

userPassword1=$(/usr/bin/osascript <<EOT

tell application "System Events"

activate

display dialog "Please enter your login password:" default answer "" buttons {"Continue"} default button 1 with hidden answer

if button returned of result is "Continue" then

set pwd to text returned of result

return pwd

end if

end tell

EOT

)



# Enables SecureToken for the currently logged in user account.

enableSecureToken() {

    sudo sysadminctl -adminUser $adminUser -adminPassword $adminPassword -secureTokenOn $userName1 -password $userPassword1

}



# Creates a PLIST containing the necessary administrator and user credentials.

createPlist() {

    echo '<?xml version="1.0" encoding="UTF-8"?>

    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

    <plist version="1.0">

    <dict>

    <key>Username</key>

    <string>'$adminUser'</string>

    <key>Password</key>

    <string>'$adminPassword'</string>

    <key>AdditionalUsers</key>

    <array>

        <dict>

            <key>Username</key>

            <string>'$userName1'</string>

            <key>Password</key>

            <string>'$userPassword1'</string>

        </dict>

    </array>

    </dict>

    </plist>' > /private/tmp/userToAdd.plist

}



# Adds the currently logged in user to the list of FileVault enabled users.

addUser() {

    sudo fdesetup add -i < /private/tmp/userToAdd.plist

}



# Enables FileVault using a Personal Recovery Key.

enableFileVault() {

    sudo fdesetup enable -inputplist < /private/tmp/userToAdd.plist

}



# SecureToken enabled users are automatically added to the list of Filevault enabled users when FileVault first is enabled.

# Removes the specified user(s) from the list of FileVault enabled users.

removeUser() {

    sudo fdesetup remove -user $adminUser

    sudo fdesetup remove -user $userName2

}



# Update the preboot role volume's subject directory.

updatePreboot() {

    diskutil apfs updatePreboot /

}



# Deletes the PLIST containing the administrator and user credentials.

cleanUp() {

    rm /private/tmp/userToAdd.plist

}



#



enableSecureToken

createPlist

if [ "$(sudo fdesetup status | head -1)" == "FileVault is On." ]; then

    addUser

else

    enableFileVault

    #removeUser     # We do not want to remove users at this time

fi

updatePreboot

cleanUp

The part of that script that is syncing the user password to the crypto account password is:

diskutil apfs updatePreboot /

In my testing that does work sometimes (I really can't say what causes it to either work or not), but I've only had 100% success with the changepassphrase command. But in many cases I have seen updatePreboot work as well.

@hkabik Without specifying the new user password, the updatePreboot command does not work. I'm using one script/policy to enable FV and to update the FV password.