login issue

Information from Etrecheck

EtreCheck version: 3.1.5 (343)

Report generated 2017-02-25 07:01:10

Download EtreCheck from https://etrecheck.com

Runtime 1:33

Performance: Excellent

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Problem: Computer is restarting

Description:

Observed the iMac to launch into startup without any visible prompt.

Hardware Information:ⓘ

iMac (Retina 5K, 27-inch, Late 2015)

[Technical Specifications] - [User Guide] - [Warranty & Service]

iMac - model: iMac17,1

1 4 GHz Intel Core i7 (i7-6700K) CPU: 4-core

8 GB RAM Upgradeable - [Instructions]

BANK 0/DIMM0

4 GB DDR3 1867 MHz ok

BANK 0/DIMM1

Empty

BANK 1/DIMM0

4 GB DDR3 1867 MHz ok

BANK 1/DIMM1

Empty

Bluetooth: Good - Handoff/Airdrop2 supported

Wireless: en1: 802.11 a/b/g/n/ac

Video Information:ⓘ

AMD Radeon R9 M395 - VRAM: 2048 MB

iMac 5120 x 2880

System Software:ⓘ

OS X El Capitan 10.11.6 (15G1217) - Time since boot: less than an hour

Disk Information:ⓘ

APPLE HDD ST2000DM001 disk0 : (2 TB) (Rotational)

[Show SMART report]

EFI (disk0s1) <not mounted> : 210 MB

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

Macintosh HD (disk2) / [Startup]: 2.10 TB (1.69 TB free)

Encrypted AES-XTS Unlocked

Core Storage: disk1s2 120.99 GB Online

Core Storage: disk0s2 2.00 TB Online

APPLE SSD SM0128G disk1 : (121.33 GB) (Solid State - TRIM: Yes)

[Show SMART report]

EFI (disk1s1) <not mounted> : 210 MB

Boot OS X (disk1s3) <not mounted> : 134 MB

Macintosh HD (disk2) / [Startup]: 2.10 TB (1.69 TB free)

Encrypted AES-XTS Unlocked

Core Storage: disk1s2 120.99 GB Online

Core Storage: disk0s2 2.00 TB Online

USB Information:ⓘ

Broadcom Corp. Bluetooth USB Host Controller

Apple Inc. FaceTime HD Camera (Built-in)

Mitsumi Electric Hub in Apple Extended USB Keyboard

Mitsumi Electric Apple Extended USB Keyboard

Thunderbolt Information:ⓘ

Apple Inc. thunderbolt_bus

Gatekeeper:ⓘ

Mac App Store and identified developers

System Launch Agents:ⓘ

[not loaded] 7 Apple tasks

[loaded] 160 Apple tasks

[running] 72 Apple tasks

System Launch Daemons:ⓘ

[not loaded] 46 Apple tasks

[loaded] 155 Apple tasks

[running] 89 Apple tasks

User Login Items:ⓘ

iTunesHelper Application (2017-01-23)

(/Applications/iTunes.app/Contents/MacOS/iTunesHelper.app)

Garmin Express Service Application (2017-01-15)

(/Applications/Garmin Express.app/Contents/Library/LoginItems/Garmin Express Service.app)

Internet Plug-ins:ⓘ

Default Browser: 601 - SDK 10.11 (2016-07-30)

QuickTime Plugin: 7.7.3 (2016-12-21)

Safari Extensions:ⓘ

Ghostery - GHOSTERY, Inc. - https://www.ghostery.com/ (2017-02-24)

3rd Party Preference Panes:ⓘ

None

Time Machine:ⓘ

Skip System Files: NO

Auto backup: YES

Volumes being backed up:

Macintosh HD: Disk size: 2.10 TB Disk used: 416.10 GB

Destinations:

WD My Book 4 TB [Local]

Total size: 4.00 TB

Total number of backups: 7

Oldest backup: 2/23/16, 2:07 PM

Last backup: 1/8/17, 12:42 PM

Size of backup disk: Adequate

Backup size 4.00 TB > (Disk used 416.10 GB X 3)

WD My Book 2 [Local]

Total size: 4.00 TB

Total number of backups: 8

Oldest backup: 4/15/16, 3:29 PM

Last backup: 2/24/17, 1:38 PM

Size of backup disk: Adequate

Backup size 4.00 TB > (Disk used 416.10 GB X 3)

Top Processes by CPU:ⓘ

2% kernel_task

2% WindowServer

2% fontd

0% cloudpaird

Top Processes by Memory:ⓘ

811 MB kernel_task

377 MB com.apple.WebKit.WebContent(3)

352 MB mdworker(20)

279 MB Safari

238 MB Mail

Virtual Memory Information:ⓘ

4.90 GB Available RAM

3.52 GB Free RAM

3.10 GB Used RAM

1.38 GB Cached files

0 B Swap Used

Diagnostics Information:ⓘ

Feb 25, 2017, 06:50:47 AM Self test - passed

Feb 24, 2017, 12:35:04 PM /Library/Logs/DiagnosticReports/Keychain Access_2017-02-24-123504_[redacted].hang

/Applications/Utilities/Keychain Access.app/Contents/MacOS/Keychain Access

There are related threads, some of which point to a combination of FileVault effects and i/o board hardware issues.

macOS Sierra FileVault enabled freezing at login

Cannot login when Filevault is enabled

One more call with Apple Support.

After that, Genius Bar appointment is the next step, as suggested by Eric Root.

Revisited keychain account passwords. All five user accounts appeared to have matching user and keychain passwords. I reset the password on the principal admin account and keychain to new matching passwords. Did not appear to make a difference.

The content of the keychains is of course different for each account. Event here 2017 02 24 is one year plus two days past startup day for this machine. That does suggest that a key may possibly have expired. However, in keychain access the keys present today do not show expiration dates.

EtreCheck appears to indicate no adware or malware detected.

EtreCheck does report keychain Access hang on 2017 02 24. That's the hang that occurred while looking for work arounds about one hour after the system first failed to recognize the password for the unlock box. That hang was stuck in wheel for about one half hour before force quit and shutdown.

Checked

/Library/LaunchAgents

/Library/LaunchDaemons

These folders have no contents.

Thank you Eric Root.

In System Preferences / Users&Groups/Login Option this change does not take effect.

The next shutdown / startup does not change to name and password, and does not show the icon for the primary account. What shows is three of five accounts on this machine, counting Guest as an account. Two do not show.

The workaround of logging in to secondary admin account, then logging out, does show name and password. Thus I still can get in to primary admin account.

Primary never shows in icon view. This is a change.

cheers,

iGardener

Update. Left machine in sleep mode, logged in to primary admin account. Overnight it appeared to attempt to start up, sounding the chord, roughly every 90 seconds. I had to pull the power cord. Next step is boot in safe mode and see if I can generate a bootable external drive with a clean OS.

Update.

Reset NVRAM curiously generates two startup tones, not one, both of them weak not the usual sound level.

Machine will not restart in safe mode (shift key). Goes directly to login screen.

Apple Diagnostics ran and reported no issues found Reference Code ADP000.

With that result, Apple Support assigned an Apple Case ID and called. They agreed to help work this issue.

cheers,

iGardener

Apple Support is still working on this.

Meanwhile set up a bootable external drive starting with new media.

No problem erasing the media and setting Mac OS Extended (Journaled).

GUID partition table.

Installed OS X 11.6 from Recovery Mode startup. No issues.

Restored from TimeMachine backup accepting all the categories of data.

Launched and executed ok.

TimeMachine backup launched immediately from this startup.

I chose to cancel that action as I wanted to think about the effects.

Restart.

Login screen is restored to normal - icons for all accounts - or name and password box as selected.

Runs correctly from restart. Selects external drive for startup.

No issues to see. Based on a very quick look everything appears to be present and working.

At least a partial success.

Based on this result appears next step is to call Apple Support, and then re-install OS to internal Mac HD, preserving user data.

Thank you Eric Root and others.

One more question:

From the external boot drive startup, Finder prompts for passwords for the both the external Time Machine drive and the internal Mac HD.

Finder accepts the password for the external TimeMachine drive.

Finder did not accept the password to unlock the internal Mac HD.

What password is Finder prompting for?

Main admin account p/w

Keychain password

Master password

Apple ID password

Finder does prompt for password, not recovery key.

cheers,

iGardener

Thank you Eric Root.

I tried

Main admin password

Previous Main admin password

(Keychain password same as Main admin password)

Previous keychain password

Secondary admin password

Apple ID password

Master password

Recovery Key

I was a little surprised, as I had understood "Master password" to be valid in all contexts on this machine.

Throughout this exercise Apple ID password is unchanged.

cheers,

iGardener

Update.

Apple Support is no longer working on this.

iMac worked fine on external bootable drive, re-installed OS X and Time Machine restore.

Went in to re-install OS X 10.11.6 from recovery drive.

Process in recovery mode did not recognize primary admin account password.

Did not recognize master password.

Process did recognize secondary admin account password.

Re-installed OS X on internal Mac HD ran fine but only briefly.

No change in password issues.

Started up again in recovery mode.

Disk Utility.

Erase process has failed.

Unable to delete the core storage logical volume.

Restart to recovery mode.

Disk utility.

Selected First Aid.

First Aid could not be completed.

Cocoa error -1.

iMac now will not complete startup under secondary admin account.

Startup makes progress partway.

Then black screen rolls down from the top, displaying only a white circle with a bar.

Shut down with power switch.

iMac now will not start up using internal disk. Black screen, white circle with bar through it.

Shutdown.

Startup in recovery mode command+R.

Opened Disk Utility.

GUID Partition Table.

2 TB Fusion Drive shown.

1.3 TB used, 700GB available.

Fusion Drive in this case meaning OEM dual 250 GB SSD and disk combination.

Mac HD not shown.

iMac continues to start up and operate correctly using external drive.

Thank you Lexiepex.

Trim not installed, not that I know of.

Not familiar with Trim.

Other information discussed by phone with Apple Support may pertain.

Internal HD is protected with FileVault.

External Mac startup disk is not.

Not utilizing iCloud or iCloud keychain.

More about iMac:

iMac 27 Late 2015 purchased refurbished directly from Apple February 2016.

Thus some element of data structure on disk may possibly reflect previous owner.

Initial problem noted 24 February 2017, one year after first startup this location.

More information from Disk Utility:

Sidebar Detail Pane

Internal

Fusion Drive Fusion Drive

2.12 TB CoreStorage Logical Volume Group

Location: Internal Capacity: 2.12TB

Connection: SATA Child count: 2

Partition Map: GUID Partition Map Type: Fusion Drive

S.M.A.R.T. status: verified Device: Virtual

Disk Images

Apple Disk Image Apple disk image Media

2.15 GB Disk Image External Physical Disk

OS X Base System 2.01 GB

Location: External Capacity: 2.15 GB

Connection: Disk Image Child count: 1

Partition Map: GUID Partition Map Type: Disk

S.M.A.R.T. status: Not Supported Device: disk0

OS X Base System OS X Base System

2.01 GB Disk Image External Physical Volume OS X Extended

Mount Point: / Type: Disk Image External Physical Volume

Capacity: 2.01 GB Available: 715.3 MB

Used: 1.3 GB Owners: Enabled

Device: disk0s1 Connection: Disk Image

Thank you Eric Root and others. The iMac 27 Late 2015 is once again running correctly. The trip to the Apple Store proved instructive. The technician used Apple diagnostic software to check the machine for hardware problems, finding none.

Then the technician looked at low level logical structure of the FusionDrive, describing it as a complex system, in which software causes one solid-state drive and one disk drive to emulate a single disk drive. The low-level software developed some kind of problem, such that the disk utility program did not recognize a Macintosh HD partition on the FusionDrive.

The tech indicated he had seen this issue before with FusionDrive. The tech also stated that this had nothing to do with the setup of this particular machine or use of FileVault. The issue is with FusionDrive.

The answer was to clear both the SSD and disk drive using unix commands in Terminal, and then to create the correct logical structure, starting from the beginning. These are the steps taken, approximately, for illustration only. The tech worked from notes he had taken on a previous occasion when he worked this problem.

diskutil zerodisk disk0 < caution: command syntax incorrect - illustration only

diskutil zerodisk disk1

diskutil create FusionDrive

diskutil create Mac HD

Once these steps were completed correctly the tech installed a clean image of MacOS Sierra 10.12.3. The operating system setup ran normally, taking a restore from the most recent backup volume.