Someone cannot get into their laptop. Before you reach for a recovery key, work out which of four things is actually happening — because three of them are quick and one of them erases the machine. The first rule is to stop them guessing.
Feature/Functionality
Overview
Four causes cover nearly every case:
- They have forgotten it, usually after time off or a recent change.
- They are typing it correctly on the wrong keyboard. AZERTY and QWERTY produce different characters from identical keystrokes.
- A policy changed — length, complexity or rotation — and forced a change they did not finish.
- On a Mac, the prompt is not asking for their password at all. Some screens ask for an account that holds a SecureToken, which may be a different account entirely.
Tell them to stop trying before you do anything else. Repeated failed attempts on a Mac can drop the machine into recovery mode, which turns a five-minute fix into a long afternoon.
How to use — rule out the cheap causes first
Get them to type it where they can see it. Any visible field will do — the username box, for instance. Half of these calls end here.
Then check the keyboard layout, which is the cause people never suspect:
- macOS: System Settings > Language & Region > Input method
- Windows: Settings > Time & Language > Language & Region
Then check whether you changed the rules on them. Go to Settings > Security > Password policies and look at what applies to that device. A policy that landed last week may have demanded a change they never completed.
How to use — the Mac case that looks like a wrong password
On macOS, some prompts — unlocking FileVault, admin-level actions, anything after a policy change — want an account with a SecureToken, not the everyday login password. An employee can know their password perfectly and still be stuck, because the prompt is for a different account.
Check it on the device:
sysadminctl -secureTokenStatus <username>The output says ENABLED or DISABLED for that user. If it is disabled, an admin account that already holds a token can grant one:
sysadminctl -secureTokenOn <user> -password <password> -adminUser <admin> -adminPassword <admin_password>The lasting fix is not per-device: use MDM > Profiles > Admin User Management so every Mac has a bootstrap admin account with a token already on it.
If someone cannot unlock FileVault with a password you know is correct, this is almost certainly why.
How to use — the four ways back in
Pick by the state of the device, in this order:
| Option | Use it when | Cost |
|---|---|---|
| Reset remotely | The device is online and has an admin session | Nothing |
| The linked Apple or Microsoft account | An account is tied to the device | Nothing, but it is in the employee's hands |
| The recovery key | The device is offline or not talking to you, and the disk is encrypted | Nothing, if the key was escrowed |
| Full reset | Nothing else works | Everything local is erased |
For the recovery key route, open the device record and go to Information > Recovery key, unlock the session locally with it, then set a new password. It only works if encryption was on and the key actually reached the server — which is decided months before you need it.
The full reset is the end of the line, and it is irreversible.
Tips and Best Practices
- "Stop trying" is the first thing you say on the call. Everything else gets easier if the Mac has not gone into recovery.
- Check the keyboard before the password policy. It costs ten seconds and it is a surprising share of the cases.
- Deploy a bootstrap admin account with a SecureToken to every Mac now. It is the difference between a remote fix and a wipe, and you cannot add it during the incident.
- Verify recovery keys are escrowed, not just that encryption is on. An encrypted disk with no key on the server is the full-reset path.
- Announce password policy changes before they take effect. Most of these tickets arrive the morning after a silent change.
Troubleshooting and FAQ
Troubleshooting
The password is definitely right and the Mac still refuses it. The prompt wants a SecureToken account. Check the token status before anything else.
The Mac has gone into recovery after repeated attempts. Recovery is now harder and may need the recovery key. This is what the warning at the top is for.
There is no recovery key on the device record. Either encryption was never enabled or escrow never completed. Neither can be fixed retroactively — the remaining route is a full reset.
Remote reset is greyed out. It needs the device online and an admin session present on it. One of the two is missing.
FAQ
-
Can we reset a password on a device that is offline?
Not remotely. Use the recovery key locally, or the linked Apple or Microsoft account. -
What is a SecureToken, in one line?
A permission on a macOS account that lets it unlock the encrypted disk. Without it, the right password is still refused. -
Does using the recovery key erase anything?
No. It unlocks the session so a new password can be set. -
How do we stop this happening?
Encryption with escrowed keys, a bootstrap admin account on every Mac, and telling people before you change the rules.