MacBook login password refused

Glad to hear that your hardware is good! It's good practice to block the serial number (as you did); however it's safe (and helpful) to reveal the error code. Considering that your hardware is good, I'm guessing you got ADP000.

Regarding the lack of backups, that is unfortunate. Let's see if we can pull your Mac's data and put it in a safe place. Try these steps to see if it is possible:

First, reset NVRAM

Try the steps you linked again to reset your NVRAM. Press and release the power button first, then immediately hold down Option-Command-P-R. Keep holding these four keys until the Apple logo appears and disappears two times.

If nothing happens, a firmware password might be set. To check for one, hold down the Option key as you power on your Mac. If you see this screen, a firmware password is set (either by you or a previous owner), and you won't be able to complete the rest of these steps.

Second, reset the System Management Controller (SMC)

To reset the SMC on your Intel-based Mac, follow these steps: How to reset the SMC of your Mac - Apple Support (CA)

Third, try these steps

Now that you have reset NVRAM and the SMC, hopefully your Mac should allow you to sign in with your Apple ID when running the Password Reset Assistant. Try these steps:

1. Run the Password Reset Assistant from Terminal using the resetpassword command.
2. Try to reset your password using your Apple ID. Sign in when prompted.
3. Once you've signed in with your Apple ID, your Mac will pull the recovery key stored in iCloud and use it to unlock your startup disk. You should now see the second screenshot.
4. Press Command-Q to quit the Reset Password app.
5. If a Terminal window appears or is still onscreen, press Command-Q again to quit Terminal.
6. You should now see the list of utilities. Select Disk Utility and click Continue.
7. Select Macintosh HD in the sidebar.

After step 7, look at the buttons presented at the top of the window, and let me know what you see:

• If you see the Mount button, click on it. If you see a password prompt, unfortunately the system decided to lock your startup disk again for no good reason.

• If you see the Unmount button instead, you're golden. Your startup disk is still unlocked and your data can be moved to a safe location.

Thanks for testing that out on the login screen. I’m concerned that your data could be lost forever.

When you first set up your Mac, you might have been prompted to enable FileVault. It can also be enabled or disabled from System Preferences -> Security and Privacy.

When FileVault is enabled, it protects your data from physical attacks by encrypting (scrambling) it, so that you need a key in order to decrypt (unscramble) the data. Keys are generated and managed by FileVault automatically, but configured in such a way that you need your password in order to access the appropriate keys. If you cannot access the encryption keys, your data is lost forever.

FileVault typically uses the following key structure. All of your data is encrypted using a Volume Encryption Key (VEK). This key isn’t directly accessible; instead, it is itself encrypted (wrapped) using an intermediary key, the Key Encryption Key (KEK). The KEK is then encrypted using the hash of your login password.

So, when you want to start up your Mac, the unlocking process looks like this: You enter your password at the login screen when prompted. Your Mac then takes your password, transforms it into a hash, and then uses that hash as a key to decrypt the KEK. If that succeeds, the KEK is used to decrypt the VEK. At this point, the system informs you that your password is correct, and uses the VEK to access your data. If any point in the above process fails, the system assumes that you provided the wrong password, and it cannot access your data.

When you set up FileVault, it creates a recovery key in case something goes wrong. The recovery key provides another way to decrypt the KEK and access your data, in case something goes wrong with your password (or if you forget your password). If you enabled FileVault in Setup Assistant, it will automatically store the recovery key in iCloud (hence why you had to log in with your Apple ID and password).

To check whether FileVault is active on your (Intel-based) Mac, look for these signs:

When you start up normally, the Apple logo appears, and then you immediately see the login window. A progress bar does not appear until you provide the correct password.

The Password Reset Assistant requires your Apple ID, your login password, or the recovery key in order to continue. If FileVault is disabled, it does not need these items to reset your password, since it already has access to your data.

In Disk Utility, if you select “Macintosh HD” and click the Mount button, it asks for your password. This is because it cannot read the contents of your startup disk without the VEK, and your password is needed in order to gain access to the VEK.

I’m concerned that some process (perhaps the Password Reset Assistant) was able to get the KEK, but failed to configure it so that the new password would unlock it. While corruption is extremely rare (I have never experienced it before), it’s not impossible.

Try these steps to determine how FileVault is set up on your Mac.

1. Start up in macOS Recovery.
2. In Disk Utility, select “Macintosh HD”, and click the Mount button. Let me know if you see a prompt for a password or not. (It’s ok to cancel the prompt.)
3. Quit Disk Utility. Then, at the top of the screen, select Utilities -> Terminal.
4. Type this command, exactly as shown, and hit Enter (Return): diskutil apfs listusers “Macintosh HD”
5. Post the output here.

Hi jacopo275,

Thanks for that info!

I can infer that FileVault is enabled on Macintosh HD for a couple of reasons:

• The "diskutil apfs listusers" command returned recovery key info about the Macintosh HD volume. That info is consistent with a typical FileVault + iCloud setup.

• By default, your Mac tries to mount (make accessible) most volumes by default. Macintosh HD was not mounted in your screenshots, implying that something is blocking the mounting process (such as the need for a FileVault password).

To double-check whether Macintosh HD is encrypted or not, run this command in Terminal: diskutil info "Macintosh HD"

If you have access to another Mac, try these steps:

Try using a bootable installer:

A bootable installer contains a fresh copy of macOS Recovery and the macOS installer.

1. On a healthy Mac, download macOS Mojave.
2. Once macOS Mojave is downloaded, connect a 16 GB flash drive. Rename it to "MyVolume".
3. Follow these steps to prepare it as a bootable installer: How to create a bootable installer for macOS - Apple Support
4. Start up from the bootable installer on the problematic Mac.
5. Try the Password Reset Assistant again (go to Terminal, run "resetpassword"). Let me know what you see when the assistant first opens.

Try using Target Disk Mode:

1. Connect your Mac to another Mac using (most likely) a Thunderbolt 3 cable.
2. Restart the problematic Mac while holding down the T key. Release the key when the Thunderbolt and USB icons appear onscreen.
3. On the other Mac, check Disk Utility to see if it recognizes the problematic Mac, and if it mounts "Macintosh HD" from it.

Thank you for those details! It looks like FileVault should be intact - the iCloud Recovery Key configuration looks correct. (It should consist of a user and an external key).

Regarding the info pane in the second screenshot: it looks like you showed the info for the APFS container (the APFS partition residing on the internal drive). The container itself isn't encrypted, nor does it hold any data on its own. Rather, the container holds these APFS volumes (in your example):

• Macintosh HD (in macOS Mojave, this holds both macOS and your data)
• Preboot (contains boot materials and login info)
• Recovery (contains macOS Recovery)
• VM (used for swap memory)

Each AFPS volume has its own encryption state and case-sensitivity policy. By default, all of the above volumes are NOT case-sensitive, and the bottom three volumes cannot be encrypted. (Macintosh HD can be encrypted using FileVault, which it is.)

Regarding Terminal inputting the wrong keys, I wonder if this is happening in both the preboot environment (where the first login screen appears) and in all of macOS Recovery. Try these steps:

1. If you don't have one, purchase or borrow an external US keyboard that uses the QWERTY format.
2. Shut down your Mac.
3. Connect the external keyboard to your Mac, then power on your Mac normally.
4. Try using the external keyboard to enter your password.

If that works, fantastic - you got your data back! We could probably resolve the root issue pretty quickly.

If the above 4 steps don't work, start up in macOS Recovery, and try using your external keyboard to type commands in Terminal. Check if the keys send the expected input.

Hi jacopo275,

Thanks for the detailed post!

jacopo275 wrote:

Possibly related observations are that

the problem appeared after that the audio was not working anymore, and after having checked that my audio settings seemed ok, I just restarted the session to see if the problem disappeared.

• the laptop seems to use a lot of battery for doing nothing while on the login page, it gets very hot and the laptop fans make a lot of noise.

These sound like hardware issues. Try starting up your Mac while holding down the D key (or Option-D if that doesn't work) to run hardware diagnostics. If any hardware issues are detected, that could be a problem.

Regarding your password, try booting into macOS Recovery and loading the Password Reset Assistant (via Terminal) as usual, but try either "My password doesn't work when logging in" or "My keyboard isn't working when typing my password to log in". If you select the latter option, you'll be asked for your password to disable FileVault. If successful, decryption will begin, and you can recover your data.

Also, do you have a Time Machine backup of your Mac?

Hi jacopo275,

When FileVault is enabled on your Mac, your password and the recovery key are the only items that can cryptographically unlock your Mac. Touch ID cannot supply the necessary info needed to unlock your data. (Data unlocking occurs when the first login screen is shown after starting up your Mac. Future prompts for your password also accept Touch ID because your data is already unlocked.)

Just to confirm, what happens if you start up your Mac normally and enter the correct password? Does your Mac act as if it is incorrect and shake the password box? Or does it accept the password, attempt to start up but fail?

Hi jacopo275,

That must be frustrating. Try skipping steps 1-5 in the third section and let me know the results.