The Mac operating system has a feature called Keychain that allows for secure storage of passwords and the like to access various services. For Keychain to be secure, it must be encrypted, and the user's login password is used as the encryption key. Sometimes, on login, users will receive a warning message about the Keychain being locked. This happens when someone a) uses a Mac using central authentication, and then b) changes their password on that central account. The result is that the local Keychain file is encrypted with the user’s old password. On login, the Keychain is normally decrypted using the password the user enters, but since the user’s password is now their new one, it won’t work.
There are a few of fixes for this:
- On login, the user receives a first prompt about the Keychain. It will look something like this:
At this point, if the user selects to Update Keychain and enters the OLD password, it will decrypt, re-encrypt with the new one, and all will be good. The user can also click Create New Keychain at this point to flush the old one and any saved contents (probably not an issue on our machines 99% of the time) and make a new one.
- Open the Keychain Access utility (/Applications/Utilities/Keychain Access). In there, are items to manage the various Keychain files. The "login" keychain is the one in question. From here, a user can delete it, make a new one, lock or unlock it, etc. Most users probably won’t want to do this, but it is a fix that the AV techs could guide them through.
- Delete the user’s entire home directory so that it will be a fresh new login with a fresh new Keychain the next time they login. This is a fix that ACS staff can do. Route a case to them.