We’re seeing an issue on multiple (more than 10 Macs, multiple hardware specs) Sonoma (14.8.8) devices which have attempted the 14.8.9 update in the last week. The OS update seems to fail, and the machine reboots, but afterwards no users are able to login (login window shakes as if incorrect password was entered, for all accounts).
Booting to recovery we can use the existing user accounts to unlock the disk without any issue, so doesn’t seem to be a SecureToken issue. Using the resetpassword option from Recovery doesn’t fix the issue either, the users are all still unable to login after rebooting to the normal drive. Safe mode doesn’t help either. We can thankfully backup the users’ files (via the terminal in recovery) to an external drive, but the system itself seems to be completely hosed, and has to be erased and have a fresh OS installed.
Any ideas what might be causing this sort of issue? I’ve never come across something like this before.
Sonoma devices can't log in after attempting 14.8.9 update
+3
We have observed the same experience with Sonoma in our environment. Since the number of affected machines was very low, we did not investigate the root cause and instead moved them to Tahoe.
However, I am interested to know if anyone else has found any information or insights regarding this issue.
+3Apple made some changes with the latest security updates on macOS 14 and 15 that don’t play nice with Jamf Connect (apparently) or BeyondTrust (in our case), and end up corrupting the auth.db.
Renaming or deleting /var/db/auth.db will allow users to log in again.
+10My org encountered the same issue so we set a policy to reset the authchanger. We had it execute the command: /usr/local/bin/authchanger -reset
It’s not a bash script but a File and Process. Set the trigger to Startup, Login, and recoccuring Check in.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.