Catalina 10.15.7 bound to AD.
Local admin the second account which is a user with admin privileges - isn't able to log in after attempting to reset the password.
Did a force unbind the system
Booted to recovery (tested with WiFi on and off)
From Terminal - resetpassword. Using the password recovery tool I'm unable to set that second account password because it says 'authentication server could not be contacted'
A bit confused as to why it even attempts that if the bind to AD isn't there anymore. Removing & re-adding the account is a nuclear option I can't use just yet.
I see posts with this error using dsconfigad and attempting to bind but I haven't found a solution for when in recovery mode
Is the second account a directory service user? Cached account directory service accounts are marked as having remotely administered passwords, even if the binding is gone. As a result, local password tools, including resetpassword, won't touch them for fear of creating an inconsistency with the directory service.
It's possible it could have been as simple as his note above - however, _
I had to issue a decrypt File Vault from Jamf - I then ran Rich Trouton's script - https://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/migrate_ad_mobile_account_...
AFTER BACKING UP
I still couldn't change the password under the recovery partition so as the last attempt - I logged into the local admin account.
I copied the UID of the user account - I then deleted their account and selected to KEEP HOME FOLDER AS-IS
I then created a new account - and right-clicked on it to Advanced Options. I set the UID to the same as the account I removed - then pointed it to the existing home directory -- the key here is that when you create the new account - the username of the account has to be identical to the home directory name.
Rebooted and logged in with the new user (which matched the old home directory name) and new password I set and was able to get to the files.
Granted - I didn't document what security updates this had so your mileage may vary. This by no means was an official fix. I think I got lucky.