Category filter

How to reset a user’s login password on macOS devices?

A passcode policy sets password rules for every user account on a Mac, such as minimum length, complexity, expiry and the maximum number of failed login attempts. If a password doesn’t meet the rules, the user must change it at their next login. Until they do, the device is marked as non-compliant.

Users are usually locked out after too many failed login attempts, often because they forgot a new password. Depending on the policy, the account is then locked for a set time or disabled. This guide explains how users and IT admins can regain access, whether the account was disabled or the password was forgotten.

How do I enable a disabled account using Hexnode UEM?

If the device is enrolled in Hexnode UEM, the disabled user account can be enabled from the Local Accounts tab in the Hexnode UEM console.

Login into your Hexnode UEM portal.
Navigate to the Manage tab. Click on the macOS device with the disabled account.
Click on the Local Accounts tab to display the user accounts on the device.
Click on the name of the user that you want to enable.
Click Actions and choose the Enable User option.
Click Proceed in the confirmation dialog box.
Click Confirm to enable the user.

Upon enabling the user account, open the respective Mac and enter the password for the user account to unlock the device.

How do I reset a forgotten password on macOS?

The following methods will guide you in changing the login password using an admin account or resetting the password with Apple Account credentials or a FileVault recovery key.

1. Changing account password using admin credentials

There are two ways to reset the password using the device administrator’s credentials: IT admins can either use Hexnode’s remote action, or users can manually reset it from the device. Choose either method and follow the steps below.

From Hexnode UEM:

Using the device administrator’s credentials, a user’s account password can be reset via the Change Password remote action.

To execute this action:

Navigate to Manage > Devices.
Select the macOS device whose user account password you want to change.
Click the Local Accounts tab.
You can either:
- Click the name of the user, then click Actions and select Change Password, or
- Click the three-dot menu corresponding to the user and select Change Password from the dropdown.
Under Administrator account credentials, enter the username and password of an admin user.
Under Target account details, enter the new password and password hint for the user.
Click Proceed, then Confirm to apply the password change.

Note:

When setting a password with special characters, it is recommended to exclude characters like ¡, ™, £, ¢, ∞, §, ¶, •, ª, º, –, ≠, «, ‘, “, æ, …, ÷, ≥, ≤.

From device end:

Prerequisites:

This method is best suited for devices that do not have a known Apple Account signed in and have FileVault turned off.

When a standard user account is disabled, the device password can be reset using the admin account credentials with the following steps:

At the Mac’s login screen, log in to the administrator account.
Once logged in, open System Settings and go to Users & Groups.
From the list of user accounts, click on the Info button right next to the standard user account to reset the password.
Authentication is required to change the password, use the admin credentials to authenticate to proceed further.
Change the user’s password by entering a password in the ‘New Password’ and ‘Verify’ fields.
Logout of the administrator account and log in to the standard user account with the new password.

When the user account is associated with an Apple Account, this Apple Account can be utilized to reset the login password directly from the login screen.

Prerequisites:

The setting “Allow user to reset password using Apple Account” should be enabled. You can find this setting on the device under System Settings > Users & Groups by clicking the info button next to a user account.
The devices with Apple Account logged in and FileVault is off.

Simply click the question mark next to the password field of the respective user account on the login screen.
Click on the “Reset it using your Apple Account” option to reset the password using Apple Account.
A “Reset Password” dialog box pops up, enter the Apple Account credentials and click Reset Password. Note that this might create a new keychain.
A dialog box describing the new system keychain creation pops up, click OK and the Mac restarts in macOS Recovery. Select a volume on which the users exist to reset the login passwords.
If you know the admin credentials of the device, you can click on the admin account, enter the credentials and continue to reset the password for the desired standard account.
If you don’t know the admin the credentials of the device, click on the “Forgot all passwords?” option.
A window describing an option to deactivate Mac pops up, click on Deactivate Mac.
A dialog box appears mentioning an internet connection is needed to reactivate the Mac. Click on Deactivate to reset the password for all the users.
Now you get the option to set password for all the users present on the device. You must reset the password for all the users to continue.
After setting the new password the device asks you to restart and login using new passwords. Click on Restart.

Note:

After logging in to your account following a password change, you may be prompted to enter your Apple Account password multiple times. This could happen because a new keychain is created after the password change, and the Apple Account password is stored in the previous keychain.

If the device has no Apple Account logged in, but the FileVault is turned on, the Filevault recovery key can be used to reset the login password.

Prerequisites:

The 24-character FileVault recovery key.

Select the user account for which you want to change the login password. Simply click the question mark next to the password field of the respective user account on the login screen.
Click on the arrow beside “Restart and show password reset options” option to reset the password using FileVault recovery key.
Choose a volume which contains the specific user data to reset the login password.
Enter the 24-character FileVault recovery key to continue.
Select the user to reset the login password.
Once the new password is set, the system asks for a restart to apply the changes, click on Restart.
Now the user can use the new password to login to their devices.