login-keychain-filevault-sos.md

Login Keychain & Filevault Emergency Recovery

Login as startupuser, then:

Fixing The Login Keychain

sudo bash
su - $MY_USERNAME
security set-keychain-password /Users/$MY_USERNAME/Library/Keychains/login.keychain-db
# Enter the old & new passwords when prompted
security unlock-keychain /Users/$MY_USERNAME/Library/Keychains/login.keychain-db
# Enter the new password to verify

Fixing FileVault

# From local account:
sudo bash
sysadminctl interactive -secureTokenStatus $MY_USERNAME
# …should say ENABLED.
sysadminctl interactive -secureTokenOn $MY_USERNAME -password -
# 1. Enter startupuser (the local admin)'s password in the dialog when prompted.
# 2. Enter the new password in the terminal when prompted.
diskutil apfs updatePreboot /
reboot