Skip to main content
Question

Keychain Broken / AD / Changed Password

  • September 11, 2014
  • 5 replies
  • 19 views
M
Forum|alt.badge.img+1

So here at the University we have caspered Macs 10.8 and above, the issue we are having is when a users password is changed the keychain prompts for the user to enter the local items keychain password I assume their old one ? or asks for access to their login keychain .... Some people are not able to remember this leaving us with a situation where if we delete the keychain it causes other issues.

How is best to manage the keychain within the JSS so that this sort of password reset process doesnt lock the user out of the keychain?

Thanks

    5 replies

    J
    Forum|alt.badge.img+17
    • joshuasee
    • Valued Contributor
    • September 11, 2014

    Unless there is a significant need for saved passwords or certificates, don't try to manage the user keychain. Just blow it away.

    rm -rf ~/Library/Keychains/*

    It will get recreated at next login. If this is done while the user is logged in, quit Safari before erasing it and then run Safari again. Upon surfing to a site with a cacheable form, they will be prompted to recreate the keychain.

    emily
    Forum|alt.badge.img+26
    • emily
    • Hall of Fame
    • September 11, 2014

    I think @rtrouton's ADPassMon fork helps fix this too.

    ekw | jamf @ jamf
    mm2270
    Forum|alt.badge.img+24
    • mm2270
    • Legendary Contributor
    • September 11, 2014

    The ADPassMon fork is from @bentoms, not @rtrouton.

    mm2270
    Forum|alt.badge.img+24
    • mm2270
    • Legendary Contributor
    • September 11, 2014

    Also, relating to the OP, are the passwords being changed ON the Mac, or from the back end, like in AD? If its the latter, that's likely the reason the password doesn't get synced. If a users password gets changed in AD, it often breaks the password sync process on the Mac. Best practice is either to use a company password change process that syncs the change to all domain controllers, or have users change their password on their Mac. As long as the Mac's connection to AD is healthy it should feed the change back up, or if its changed through a password reset site, it should feed the same change back down to the Mac if its connected to the network.

    In cases where the login.keychain password does not get synced correctly with the change in AD, the only possible way to fix this is to know the old password so it can be unlocked FIRST, and then the login.keychain password can get reset to the new one. If the user has forgotten their old password, there is literally no way to unlock it and get back in short of using some crazy brute force password hacking system. The login.keychain password can't be easily decrypted, so your best bet is to delete it and have it recreated at next login. Yes, all previous keychain entries are lost, but there's really nothing else you can do.

    J
    Forum|alt.badge.img+7
    • joemamasmac
    • Contributor
    • January 17, 2015
    rm -rf ~/Library/Keychains/* It will get recreated at next login. If this is done while the user is logged in, quit Safari before erasing it and then run Safari again. Upon surfing to a site with a cacheable form, they will be prompted to recreate the keychain.

    Are you running this on a logout hook?

    Terms & ConditionsCookie settingsAccessibility statement