0

When I reset my macbook pro, the password gets changed. I have Yosemite 10.10.3 and Apple phone support haven't been able to get to the bottom of it yet. They suggested I re-install the OS but i'd rather find out what this is first.

To get back in to my account, I followed the instructions here to run setup assistant, create a new admin account and change my password. I can then login to my account. When I reboot or logout though, the password gets changed again.

I assume it's malware of some kind, though it isn't being detected by Sophos or ClamAV. I have Littlesnitch and can't see any suspicious processes making network calls.

How can I track down what is doing this?

2
  • If you suspect it is malware then you really should follow their advice. If you create a new non-escalated user, does it happen to that user, if it doesn't then you can use that fact to do some comparisons.
    – Ramhound
    May 22, 2015 at 13:29
  • Thanks - nice suggestion. I created a non-admin user and the password on that account survives reboots. Further, if I login to this account first then logout, The password on my account then works. If I reboot and try and log straight into my account however, the password is rejected.
    – Zeta Func
    May 22, 2015 at 13:47

2 Answers 2

1

Could it be that - for whatever reason - your Mac boots into a different keyboard layout that does not match the physical keyboard and at least one of the characters in your password is affected by that? Maybe logging into the temp account resets the keyboard layouta and afterward everything works fine?

0

Try booting to recovery with Command-R-boot. When in recovery mode, you can run Utilities > Terminal. Use the command resetpassword.

This will allow you to set a password outside your Mac environment. While you're in the terminal, you'll want to clear your keychains, which often suffer with an offline password reset like this: rm -R /Volumes/Macintosh\ HD/Users/[YourHomeFolderName]/Keychains/* and rm -R /Volumes/Macintosh\ HD/Users/[YourHomeFolderName]/Keychains/.*. (Note, the Macintosh\ HD portion depends on your Mac set up to use that as the volume label; it may be different, but you can see it in Disk Utility. The characters are, "Macintosh[backslash][space]HD".

Speaking of Disk Utility, while you're in Command-R boot, repair your disk and repair your permissions. It's possible that the permissions on your password storage file or the binary that sets passwords have gone funny and you don't have correct permissions to run-the-binary/save-the-new-password.

You may want to consider running something like applejack, which is a useful utility you install from a sourceforge downloaded package installer and run in single-user mode Command-S boot. Applejack looks for corrupt .plist files, which is one possibility for your issues.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .