Resetting the PW of a Local Standard User who has Encryption Turned On.

@rsteffens Do the users know the management admin pw? If not, do you really need to restrict their access to Users & Groups? If you do, which as you've noted eliminates access to the Change Password UI in that panel, then you'll want to look at the `sysadminctl` tool to do a scripted password change. Here's an article with details on that:

https://macnotes.wordpress.com/2019/03/28/user-management-create-remove-change-password-secure-token-from-macos-command-line/ 

Note that using this tool will require that an admin account name and password be supplied, so sending those as encrypted parameters to your script would be recommended.

There's a couple of ways to accomplish this, depending on your user setup and OS.  If you're on Catalina or above, and machines are not bound to AD and the accounts are local, I'd say use the Apple Kerberos Extension.  You can create the profile, push to your devices, and users can change their password, and it will update and keep FileVault in sync.  You could also look at NoMad or Jamf Connect.

Thanks!  I will look into these options and report what works best. Appreciate the input!

So I did some testing and found that it is the FileVault requirement that is restricting the password field. Is something wrong here?  Is requiring encryption not supposed to grey out the password field?

I'm OK to give employees Users and Groups access, as they don't know the master password. But I'm not OK to turn off the FileVault requirement.  When I exclude a test computer on this profile, the password field becomes active!

@Jason33 Regarding the Apple Kerberos Extension, I have never used it, but it sounds like it's worth looking into! Are you aware of a guide I could reference on this?  Something with instructions on where to start, download the program, etc.  All my users are local, and endpoints are running Big Sur.