Skip to main content
Question

macOS 10.14.4 work with AD : Keychain lost after updating password out of mac

  • May 9, 2019
  • 23 replies
  • 99 views
H
Forum|alt.badge.img+3

Hi everyone,

I was told Apple finally fixed AD password syncing issues on macOS 10.14.4 several days ago, which I thought is great. (https://support.apple.com/en-us/HT209149#macos10144)

However I confirmed a new issue while using 10.14.4: If I change my AD password out of Mac, and use new password to login, normally it will require me to input old password to update keychain. This time, it did notice me about it, but no step to input the old password even I choose "Update Keychain Password", then it create a new keychain for me. As my company need cert to connect wifi, this is pretty annoying.

If anyone have same situation, you can try recovery your keychain by finding it in ~/Library/Keychains/XXXXXXX

Everything worked perfectly if I change password in mac, which IT department not recommend.

Appreciate a lot if anyone can offer Apple's explanation (links or mail reply) about it. A solution will even better.

      23 replies

      C
      Forum|alt.badge.img+20
      • ClassicII
      • Valued Contributor
      • May 9, 2019

      Interesting, as I have tested almost every single 10.14.4 password situation except for this one. I don't think I ever actually clicked "Update" to see if it worked.

      I will test this out tomorrow.

      You can take a look at all my testing on the active directory and local accounts fixes in 10.14.4

      https://mrmacintosh.com/category/local-accounts/
      https://mrmacintosh.com/category/ad-mobile-accounts/

        M
        Forum|alt.badge.img+16
        • m_entholzner
        • Honored Contributor
        • May 9, 2019

        Apple has confirmed that this is a known issue / bug / defect of 10.14.4. I'd suggest to raise an Enterprise ticket with Apple and add your +1 to this defect. So far I have no bug ID, but you can add your case to ours: 20000049607662

          C
          Forum|alt.badge.img+20
          • ClassicII
          • Valued Contributor
          • May 10, 2019

          @hawkzhang45 & @m.entholzner

          Thanks for posting this, I have investigated and have also confirmed the issue. I wrote about it and posted a workaround for restoring the old login keychain.

          https://mrmacintosh.com/10-14-4-update-breaks-update-keychain-password/

          I also included an open radar.

            D
            Forum|alt.badge.img+3
            • ddixon
            • New Contributor
            • May 10, 2019

            @hawkzhang45 & @m.entholzner & @ClassicII

            What I have never understood about this whole process, is the need to have an end user enter their old Active Directory created keychain password to change to their new Active Directory created keychain password, and not lose any of their keychain data. As someone that works in a place in a Helpdesk capacity. I must assist users in changing their forgotten passwords. The need for an end user to know and enter their old password, defeats the purpose of helping an end user change to a new password, if they cannot remember their old password. Which was the reason that they called the Helpdesk for help in the first place.

              U
              Forum|alt.badge.img+1

              lol, I had met the same problem , hoping somebody help!!!

                C
                Forum|alt.badge.img+20
                • ClassicII
                • Valued Contributor
                • May 15, 2019

                This is still busted in 10.14.5

                @m.entholzner

                Any word from your ticket ?

                M
                Forum|alt.badge.img+16
                • m_entholzner
                • Honored Contributor
                • May 16, 2019

                @ClassicII , Apple told me that they don't disclose internal bug IDs... but as this is a known issue, you should be able to just set your +1 on this issue. But they also confirmed that this is not fixed in 10.14.5 - let's hope for 10.14.6...

                H
                Forum|alt.badge.img+3
                • hawkzhang45
                • Author
                • New Contributor
                • May 16, 2019

                Working on it

                  C
                  Forum|alt.badge.img+20
                  • ClassicII
                  • Valued Contributor
                  • May 17, 2019

                  Not seeing any movement on the bug report so I filed an Enterprise Support Ticket this morning.

                  C
                  Forum|alt.badge.img+20
                  • ClassicII
                  • Valued Contributor
                  • May 17, 2019

                  @hawkzhang45

                  Just saw your post now, awesome work on the script! Let me test it out and if it works.

                  T
                  Forum|alt.badge.img+8
                  • takayuki
                  • Contributor
                  • May 21, 2019

                  We also opened an Enterprise Support Ticket today to request Apple to include the fix to macOS 10.14.6 beta.

                  C
                  Forum|alt.badge.img+20
                  • ClassicII
                  • Valued Contributor
                  • July 4, 2019

                  Heads up,

                  This fix is not looking good making it into 10.14.

                  The latest word is it's fixed in 10.15 beta 2.

                  If this is important to your organization you better talk with Apple now.

                  @m.entholzner @takayuki @hawkzhang45

                  T
                  Forum|alt.badge.img+8
                  • takayuki
                  • Contributor
                  • July 7, 2019

                  Thanks for your heads-up @ClassicII .

                  We also contacted Apple Enterprise Support to request to bring this fix to macOS 10.14.6.

                  A
                  Forum|alt.badge.img+6
                  • analog_kid
                  • New Contributor
                  • July 8, 2019

                  I've also opened an Enterprise support case regarding this issue with hopes they'll resolve it in 10.14.6.

                  M
                  Forum|alt.badge.img+11
                  • mikeh
                  • Contributor
                  • July 8, 2019

                  I can confirm that the keychain password is updated properly in the latest 10.15 beta. Waiting for a response from Apple about making the fix available to 10.14.6.

                  M
                  Forum|alt.badge.img+16
                  • m_entholzner
                  • Honored Contributor
                  • July 9, 2019

                  same for us... we've also requested this to be fixed in 10.14.6 too.

                  M
                  Forum|alt.badge.img+14
                  • MTFIDjamf
                  • Valued Contributor
                  • July 24, 2019

                  Has anyone had a chance to test 10.14.6 yet? Did Apple fix it? We have a ticket open with Apple support but they have yet to answer the question on 10.14.6...

                  M
                  Forum|alt.badge.img+16
                  • m_entholzner
                  • Honored Contributor
                  • July 25, 2019

                  there was no fix included in the latest beta - maybe this changed in the release version, but I fear this is still not fixed :(

                  M
                  Forum|alt.badge.img+12
                  • mschroder
                  • Valued Contributor
                  • July 25, 2019

                  I am always amazed how long it takes Apple to fix something. This makes the enterprise support quite a bad deal :(

                    C
                    Forum|alt.badge.img+5
                    • captam3rica
                    • New Contributor
                    • September 5, 2019

                    Hi All,

                    Has there been any more movement on this topic?

                    We have been testing the latest Jamf Connect Verify KeychainItems key with the latest 10.15 beta but don't seem to be getting any luck with updating specified keychain items.

                    M
                    Forum|alt.badge.img+11
                    • mikeh
                    • Contributor
                    • September 6, 2019

                    We've have an enterprise support ticket open on this issue even since it was discovered. It's been fixed in the Catalina betas, but we've been told that it won't be backported to Mojave. Unfortunate.

                    Luckily, @ClassicII's instructions for restoring the original Keychain work like a charm. It's too bad that that it's just a little labor intensive.

                      G
                      Forum|alt.badge.img+10
                      • gabester
                      • Valued Contributor
                      • June 4, 2020

                      Super frustrated by this - which would seem to be a fairly straightforward fix, esp. on managed devices. Apple's now releasing security updates for Mojave that REMOVE FEATURES (e.g. the --ignore option) and ADDS FEATURES (ability to understand MDM profile "Major Update" deferral) and is large enough to practically be a complete OS installation, but it does not bother to implement what likely is a trivial bug fix, thereby offloading on macOS support teams an extensive effort. I shouldn't have to update my users to Catalina - which is its own bag of hurt for many kinds of user-facing prompts for permissions and access that cannot be managed - to resolve this bug. Apple ought to patch it in Security Update 2020-004 for macOS Mojave.

                      Open tickets with Apple Enterprise support. Make your voices heard.

                      M
                      Forum|alt.badge.img+12
                      • mschroder
                      • Valued Contributor
                      • July 17, 2020

                      And not even fixed in 2020-004 :(

                      Terms & ConditionsCookie settingsAccessibility statement